cyber.hendryadrian.com
Threat Research · securityonline.info

ClearSky Reports Russian-Aligned BadPaw and MeowMeow Campaign Targeting Ukraine

· Original article ↗

Summary

ClearSky details a campaign targeting Ukraine with BadPaw and MeowMeow malware. It attributes the activity with high confidence to a Russian state-aligned actor and notes a low-confidence link to APT28.

Key points

  • ClearSky reports phishing from spoofed or compromised ukr[.]net addresses, using a ZIP archive and an HTA decoy about border appeals.
  • A VBScript extracts hidden data from CAT.png using steganography to reconstruct the BadPaw .NET loader.
  • BadPaw is protected with .NET Reactor and uses a -renew parameter check; without it, the loader displays a decoy Regex Finder GUI.
  • When activated, BadPaw downloads the MeowMeow backdoor from virtualdailyplanner[.]pro.
  • MeowMeow can run PowerShell commands and read, write, and delete local files; its malicious functionality is triggered with the -v parameter.
  • MeowMeow checks for virtual machines and analysis tools, including Wireshark, ProcMon, and Fiddler, and exits if it detects them.
  • Russian-language code artifacts support ClearSky’s high-confidence Russian state-aligned attribution; the reported link to APT28 is low confidence.

Article Details

Attack Vectors
  • Phishing emails from spoofed or compromised ukr.net addresses deliver a ZIP archive containing an HTA decoy about border appeals.
  • The HTA runs a VBScript that uses steganography to extract a BadPaw payload from CAT.png.
  • BadPaw downloads the MeowMeow backdoor from virtualdailyplanner[.]pro.
  • MeowMeow supports remote PowerShell command execution and reading, writing, and deleting files on the compromised host.

Indicators of compromise

TypeIndicatorContext
DOMAINvirtualdailyplanner[.]proC2 domain contacted by BadPaw to download the MeowMeow backdoor.

MITRE ATT&CK

T1027.002 · Software PackingBadPaw is protected with .NET Reactor to hinder static analysis and reverse engineering.T1027.003 · SteganographyThe VBScript uses steganography in CAT.png to conceal and reconstruct the BadPaw payload.T1059.001 · PowerShellMeowMeow allows remote execution of PowerShell commands.T1059.005 · Visual BasicA VBScript extracts the BadPaw payload from CAT.png.T1105 · Ingress Tool TransferBadPaw downloads MeowMeow from virtualdailyplanner[.]pro.T1218.005 · MshtaThe HTA file executes as the initial loader stage.T1497.001 · System ChecksMeowMeow scans for virtual machines and exits when it detects a research environment.T1518.001 · Security Software DiscoveryMeowMeow scans for analysis tools including Wireshark, ProcMon, and Fiddler, then terminates if detected.T1566.001 · Spearphishing AttachmentPhishing emails deliver a ZIP archive containing the HTA decoy.

Threat Actors

APT28ClearSky assessed a link between APT28 and the campaign as low confidence; the article also gives Fancy Bear as an alternate name.

Malware

BadPawClearSky Team uncovered a targeted Russian state-aligned campaign against Ukraine that uses border-crossing appeals to deliver two novel malware strains, BadPaw and MeowMeow.MeowMeowClearSky Team uncovered a targeted Russian state-aligned campaign against Ukraine that uses border-crossing appeals to deliver two novel malware strains, BadPaw and MeowMeow.

Products

Eziriz .NET Reactorattack uses ukr.net phishing, an HTA/VBScript loader that extracts payloads via steganography, a .NET Reactor-protected BadPaw loader with a ‘-renew’ parameter check, and a MeowMeow backdoor that provides remote

Countries

UkraineClearSky Team uncovered a targeted Russian state-aligned campaign against Ukraine that uses border-crossing appeals to deliver two novel malware strains, BadPaw and MeowMeow.

Related Articles