Detects DLL used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ b

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging a specific DLL loader to deploy the Chrysalis backdoor, mirroring the tactics employed by the Chinese APT group Lotus Blossom during the Notepad++ infrastructure compromise. Proactive hunting for this behavior in Azure Sentinel is essential to identify early-stage intrusions and prevent potential supply chain attacks that could lead to persistent access within critical systems.

YARA Rule

rule MAL_Chrysalis_DllLoader_Feb26 {
   meta:
      description = "Detects DLL used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
      author = "X__Junior"
      date = "2026-02-02"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      hash = "3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad"
      score = 80
      id = "a2bf8cde-36a5-565d-9257-f1a4b2d67adc"
   strings:
      $op1 = { 33 D2 8B C1 F7 F6 0F B6 C1 03 55 ?? 6B C0 ?? 32 02 88 04 0F 41 83 F9 ?? 72 }
      $op2 = { 0F B6 04 31 41 33 C2 69 D0 ?? ?? ?? ?? 3B CB 72 }
   condition:
      uint16(0) == 0x5a4d and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Chrysalis Backdoor DLL Detection rule, tailored to an enterprise environment:

• Scenario: Legitimate Notepad++ Plugin Updates via Scheduled Task

  • Context: The IT department runs a nightly scheduled task (Task Scheduler) that automatically updates the Notepad++.exe installation on developer workstations. This process involves loading a specific DLL (e.g., NppPluginManager.dll or a custom updater) which shares structural similarities with the Chrysalis loader, triggering the rule when the Notepad++ infrastructure is being patched.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is schtasks.exe or msiexec.exe and the target executable path contains \Program Files\Notepad++\. Additionally, whitelist specific SHA-256 hashes of known Notepad++ update DLLs.

• Scenario: Deployment of Chinese Localization Tools by Admin Teams

  • Context: The enterprise utilizes third-party localization or translation suites (e.g., Trados, MemoQ, or custom internal tools) that are often developed by vendors with similar supply chains to the “Lotus Blossom” APT. These tools frequently inject DLLs into the Notepad++ process to provide real-time syntax highlighting or dictionary features, mimicking the Chrysalis loading behavior.
  • Suggested Filter/Exclusion: Create an exclusion for processes running under SYSTEM or specific domain admin accounts (e.g., DOMAIN\IT-Admins) where the loaded DLL path resides within a trusted software vendor directory (e.g., \Program Files\Trados\).

• Scenario: Automated Build Pipelines in CI/CD Environments

  • Context: In DevOps environments, Jenkins or Azure DevOps agents often spin up temporary Notepad