# Russian Campaign Targeting Ukraine with New Malware Duo BadPaw (.NET Loader) and MeowMeow (Backdoor)

> ClearSky identified a targeted campaign against Ukraine using two new .NET Reactor-packed malware strains. A phishing email links to a ZIP containing an HTA that shows a Ukrainian-language border-crossing-appeal lure while the BadPaw loader is installed, which after C2 contact deploys the MeowMeow backdoor. ClearSky attributes it with high confidence to a Russian state-aligned actor and with low confidence to APT28.

- **Published:** 2026-10-16T15:42:59Z
- **Last reviewed:** 2026-10-16T15:42:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3755
- **ID:** TL-2026-3755
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ClearSky Cyber Security reported (March 2026) a targeted campaign against Ukraine that uses two previously undocumented malware families: BadPaw, a .NET loader, and MeowMeow, a .NET backdoor. Secondary coverage describes Ukrainian government and energy-sector targeting with possible regional expansion.

Infection chain: the victim receives a phishing email, reportedly sent from a ukr.net address (lviv_zagin_dpsu@ukr.net is listed in one write-up), containing a link, shortened via cutt.ly, to a ZIP archive. A tracking pixel hosted on infotrackerstatistic.live confirms that the link was opened. The ZIP contains an HTA file disguised as an HTML document. When opened it displays a Ukrainian-language decoy about a border-crossing appeal while the infection proceeds in the background.

BadPaw is a .NET loader packed with .NET Reactor. It runs only dummy code behind a benign GUI (a fake 'Regex Finder' tool) unless started with the -renew parameter. It contacts the C2 domain virtualdailyplanner.pro over HTTP using the paths /getcalendar (returns a numeric response), /eventmanager (landing page titled 'Telemetry UP!', with ASCII-encoded payload delivery in HTML) and /planneractivate. It then stages a VBScript (LibHelperDemo.vbs, later UpdateHelper.vbs) and an image (CAT.png, later HelperLogo.png) under %LOCALAPPDATA%\UpdateHelpers. A PE payload is hidden in the PNG after the marker <STEGO_START> (steganography) and is extracted and run as MeowMeowProgram.exe from %LOCALAPPDATA%\MeowCheck. A scheduled task executes the VBS stage for persistence. Other artifacts reported include config.library-ms in C:\Users\Public\Libraries and WallpapperSet.jpg in the Pictures folder.

MeowMeow is also .NET Reactor-packed and shows a benign decoy (an image of a yawning cat with a 'Meow Meow Meow' message) unless started with the -v parameter. It provides remote PowerShell command execution and file-system read/write/delete. Anti-analysis checks include reading HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate and terminating if the OS was installed less than 10 days earlier (sandbox heuristic), VM detection, and termination when Wireshark, ProcMon, Ollydbg or Fiddler are found. Infosecurity Magazine reported that only nine AV engines detected the payload.

Attribution: ClearSky assesses with high confidence a Russian state-aligned actor and with low confidence APT28 (Fancy Bear). Supporting indicators are Ukrainian targeting, abuse of ukr.net (previously abused by APT28), and Russian-language strings in the code (for example a regex with 'работоспособного состояния'). Note that one secondary source describes the APT28 link as 'moderate'; ClearSky's own assessment is low. Limitation: the ClearSky article and PDF could not be fetched directly, so details come from secondary reporting that cites the report. Some artifact names and paths (for example the C:\Users\admin paths) come from sandbox analysis and may differ on victims.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1218.005 Mshta
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1480 Execution Guardrails
- T1036 Masquerading
- T1057 Process Discovery
- T1071.001 Web Protocols

## Sources

- [Exposing a Russian Campaign Targeting Ukraine Using New Malware Duo: BadPaw and MeowMeow (ClearSky)](https://www.clearskysec.com/russian-campaign-targeting-ukraine-badpaw-and-meowmeow/)
- [BadPaw and MeowMeow (ClearSky PDF report)](https://www.clearskysec.com/wp-content/uploads/2026/03/BadPaw_and_MeowMeow.pdf)
- [Multi-Stage 'BadPaw' Malware Campaign Targets Ukraine (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/badpaw-malware-targets-ukraine/)
- [Russian APT targets Ukraine with BadPaw and MeowMeow malware (Security Affairs)](https://securityaffairs.com/188974/apt/russian-apt-targets-ukraine-with-badpaw-and-meowmeow-malware.html)
- [BadPaw and MeowMeow: steganographic .NET malware hits Ukrainian targets (ThreatIntelReport)](https://threatintelreport.com/articles/badpaw-and-meowmeow-steganographic-net-malware-hits-ukrainian-targets/)
- [BadPaw and MeowMeow: Russian Cyber Offensive Targets Ukraine with Novel Malware Duo (Daily CyberSecurity)](https://securityonline.info/badpaw-and-meowmeow-russian-cyber-offensive-targets-ukraine-with-novel-malware-duo/)
- [ClearSky exposes Russian cyber operation targeting Ukraine with newly discovered BadPaw, MeowMeow malware (Industrial Cyber)](https://industrialcyber.co/ransomware/clearsky-exposes-russian-cyber-operation-targeting-ukraine-with-newly-discovered-badpaw-meowmeow-malware/)
- [Russian phishing campaign hits Ukraine with novel malware (SC Media)](https://www.scworld.com/brief/russian-phishing-campaign-hits-ukraine-with-novel-malware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3755