Threat reportMalwareTL-2026-3755
Russian Campaign Targeting Ukraine with New Malware Duo BadPaw (.NET Loader) and MeowMeow (Backdoor)
Russian Campaign Targeting Ukraine with New Malware Duo (TL-2026-3755), also tracked as BadPaw, is a high-severity malware campaign, first published 2026-10-16. It is linked to a Russia-nexus actor with medium confidence, affects Microsoft Windows, maps to 14 MITRE ATT&CK techniques (T1027, T1027.003, T1036), and is covered by 9 detection rules and 23 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-3755
- Threat ID
- TL-2026-3755
- Also known as
- BadPaw, MeowMeow, MeowMeowProgram
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, energy
- Target regions
- ukraine, 151 - Eastern Europe
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Russian Campaign Targeting Ukraine with New Malware Duo
Malware and tooling: BadPaw, MeowMeow, .NET Reactor
How Russian Campaign Targeting Ukraine with New Malware Duo works
ClearSky identified a targeted campaign against Ukraine using two new .NET Reactor-packed malware strains. A phishing email links to a ZIP containing an HTA that shows a Ukrainian-language border-crossing-appeal lure while the BadPaw loader is installed, which after C2 contact deploys the MeowMeow backdoor. ClearSky attributes it with high confidence to a Russian state-aligned actor and with low confidence to APT28.
ClearSky Cyber Security reported (March 2026) a targeted campaign against Ukraine that uses two previously undocumented malware families: BadPaw, a .NET loader, and MeowMeow, a .NET backdoor. Secondary coverage describes Ukrainian government and energy-sector targeting with possible regional expansion.
Infection chain: the victim receives a phishing email, reportedly sent from a ukr.net address (lviv_zagin_dpsu@ukr.net is listed in one write-up), containing a link, shortened via cutt.ly, to a ZIP archive. A tracking pixel hosted on infotrackerstatistic.live confirms that the link was opened. The ZIP contains an HTA file disguised as an HTML document. When opened it displays a Ukrainian-language decoy about a border-crossing appeal while the infection proceeds in the background.
BadPaw is a .NET loader packed with .NET Reactor. It runs only dummy code behind a benign GUI (a fake 'Regex Finder' tool) unless started with the -renew parameter. It contacts the C2 domain virtualdailyplanner.pro over HTTP using the paths /getcalendar (returns a numeric response), /eventmanager (landing page titled 'Telemetry UP!', with ASCII-encoded payload delivery in HTML) and /planneractivate. It then stages a VBScript (LibHelperDemo.vbs, later UpdateHelper.vbs) and an image (CAT.png, later HelperLogo.png) under %LOCALAPPDATA%\UpdateHelpers. A PE payload is hidden in the PNG after the marker <STEGO_START> (steganography) and is extracted and run as MeowMeowProgram.exe from %LOCALAPPDATA%\MeowCheck. A scheduled task executes the VBS stage for persistence. Other artifacts reported include config.library-ms in C:\Users\Public\Libraries and WallpapperSet.jpg in the Pictures folder.
MeowMeow is also .NET Reactor-packed and shows a benign decoy (an image of a yawning cat with a 'Meow Meow Meow' message) unless started with the -v parameter. It provides remote PowerShell command execution and file-system read/write/delete. Anti-analysis checks include reading HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate and terminating if the OS was installed less than 10 days earlier (sandbox heuristic), VM detection, and termination when Wireshark, ProcMon, Ollydbg or Fiddler are found. Infosecurity Magazine reported that only nine AV engines detected the payload.
Attribution: ClearSky assesses with high confidence a Russian state-aligned actor and with low confidence APT28 (Fancy Bear). Supporting indicators are Ukrainian targeting, abuse of ukr.net (previously abused by APT28), and Russian-language strings in the code (for example a regex with 'работоспособного состояния'). Note that one secondary source describes the APT28 link as 'moderate'; ClearSky's own assessment is low. Limitation: the ClearSky article and PDF could not be fetched directly, so details come from secondary reporting that cites the report. Some artifact names and paths (for example the C:\Users\admin paths) come from sandbox analysis and may differ on victims.
MITRE ATT&CK techniques used in TL-2026-3755
Defense Evasion
T1027 Obfuscated Files or Information; T1027.003 Steganography; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1480 Execution Guardrails; T1497.001 System Checks
Persistence
Discovery
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
Initial Access
Affected products and versions in Russian Campaign Targeting Ukraine with New Malware Duo
- Microsoft — Windows
Vulnerable versions: Windows systems that can run HTA, VBScript, PowerShell and .NET (no specific versions reported)
Remediation for Russian Campaign Targeting Ukraine with New Malware Duo
Immediate actions
- Block virtualdailyplanner.pro and infotrackerstatistic.live at DNS, proxy and firewall
- Block or detonate-inspect cutt.ly short links in inbound mail for Ukrainian-targeted users
- Hunt for MeowMeowProgram.exe, LibHelperDemo.vbs, UpdateHelper.vbs, CAT.png and HelperLogo.png and for the UpdateHelpers and MeowCheck directories under %LOCALAPPDATA%
- Review scheduled tasks that launch wscript/cscript against VBS files in user-profile directories
Workarounds
- Remove or disable the .hta file association for non-administrative users
- Restrict PowerShell with Constrained Language Mode and script block logging
Longer-term hardening
- Block ZIP-from-link downloads and HTA execution (mshta.exe) for standard users
- Alert on mshta.exe or wscript.exe spawning .NET processes that make HTTP requests to rare domains
- Enable attack surface reduction rules against script-launched executable content
- Train staff to treat unsolicited official-looking emails, including from ukr.net senders, as suspicious
Timeline of Russian Campaign Targeting Ukraine with New Malware Duo
- Report documents the MeowMeow backdoor (-v parameter), extracted from PNG after the <STEGO_START> marker, with remote PowerShell, file operations and sandbox/analysis-tool checks. The event date is the disclosure date.
- Report documents the BadPaw .NET Reactor loader (-renew parameter) contacting virtualdailyplanner.pro (/getcalendar, /eventmanager, /planneractivate) and staging a VBS plus CAT.png steganographic image. The event date is the disclosure date.
- Report documents the delivery chain: phishing email from a ukr.net sender with a cutt.ly link to a ZIP holding an HTA, which shows a Ukrainian border-crossing-appeal decoy. The event date is the disclosure date, not an observed attack date.
- ClearSky Cyber Security report 'Exposing a Russian Campaign Targeting Ukraine Using New Malware Duo: BadPaw and MeowMeow' is in circulation, attributing the campaign with high confidence to a Russian state-aligned actor and with low confidence to APT28.
- Infosecurity Magazine publishes the earliest dated coverage of the ClearSky BadPaw/MeowMeow report (ClearSky's exact publication day is not stated in the sources; the report is dated March 2026).
- Daily CyberSecurity (securityonline.info) publishes a detailed technical summary of the campaign and its indicators.
Sources cited for Russian Campaign Targeting Ukraine with New Malware Duo
- Exposing a Russian Campaign Targeting Ukraine Using New Malware Duo: BadPaw and MeowMeow (ClearSky)
- BadPaw and MeowMeow (ClearSky PDF report)
- Multi-Stage 'BadPaw' Malware Campaign Targets Ukraine (Infosecurity Magazine)
- Russian APT targets Ukraine with BadPaw and MeowMeow malware (Security Affairs)
- BadPaw and MeowMeow: steganographic .NET malware hits Ukrainian targets (ThreatIntelReport)
- BadPaw and MeowMeow: Russian Cyber Offensive Targets Ukraine with Novel Malware Duo (Daily CyberSecurity)
- ClearSky exposes Russian cyber operation targeting Ukraine with newly discovered BadPaw, MeowMeow malware (Industrial Cyber)
- Russian phishing campaign hits Ukraine with novel malware (SC Media)
Detection coverage for TL-2026-3755
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3755 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.