ClearSky Reports Suspected Russian Espionage Campaign Using BadPaw and MeowMeow
Summary
ClearSky reports a suspected espionage campaign targeting Ukraine: phishing ZIPs deliver BadPaw, which installs the MeowMeow backdoor. Researchers attribute it with high confidence to a Russian state-aligned actor and low confidence to APT28; targets and success are unT
Key points
- The campaign begins with phishing emails linking to a ZIP archive containing a malicious Ukrainian-language permit document.
- Opening the archive triggers the BadPaw loader, which installs the MeowMeow backdoor.
- MeowMeow can check for specific files and read, write, or delete data on infected machines.
- MeowMeow terminates itself if it detects virtual machines or common security analysis tools.
- ClearSky attributes the campaign with high confidence to a Russian state-aligned actor and with low confidence to APT28.
- Researchers say the phishing emails came from addresses hosted by ukr[.]net, but the report does not identify targets or say whether the attacks succeeded.
Article Details
- Event Type
- Suspected cyber-espionage campaign using phishing and previously undocumented malware
- Impact
- The MeowMeow backdoor can check for specific files and read, write, or delete data on infected systems. The article does not identify the campaign's targets or report whether any attacks succeeded.
MITRE ATT&CK
T1083 · File and Directory DiscoveryMeowMeow can check whether specific files exist on an infected device.T1105 · Ingress Tool TransferOpening the archive triggered the download of the BadPaw loader.T1497.001 · System ChecksMeowMeow checks for virtual machines and sandbox environments and terminates if it detects them.T1565.001 · Stored Data ManipulationMeowMeow can write to or delete files on compromised machines.T1566.002 · Spearphishing LinkThe suspected campaign used phishing emails containing a link to a ZIP archive.
Threat Actors
APT28ClearSky assessed a link between APT28 and the suspected campaign with low confidence.BlueDeltaThe article identifies BlueDelta as another name for APT28, whose link to the suspected campaign ClearSky assessed with low confidence.Fancy BearThe article identifies Fancy Bear as another name for APT28, whose link to the suspected campaign ClearSky assessed with low confidence.UAC-0252CERT-UA attributed a separate campaign targeting Ukrainian government institutions and involving ShadowSniff and SalatStealer to UAC-0252.
Malware
BadPawcontaining a ZIP archive and a malicious Ukrainian-language document, which triggers a loader called BadPaw and installs a backdoor named MeowMeow.MeowMeowUkrainian-language document, which triggers a loader called BadPaw and installs a backdoor named MeowMeow.SalatStealerClearSky attributes the campaign to a Russian state-aligned actor, with low-confidence links to APT28; CERT-UA separately reported ShadowSniff and SalatStealer activity by UAC-0252.SHADOWSNIFFClearSky attributes the campaign to a Russian state-aligned actor, with low-confidence links to APT28; CERT-UA separately reported ShadowSniff and SalatStealer activity by UAC-0252.
Countries
RussiaWidely believed to be linked to Russia’s military intelligence agency, APT28 has previously conducted cyber-espionage and credential-harvesting operations against government agencies, defense contractors, weaponsUkraineResearchers report a suspected Russian espionage campaign targeting Ukraine that starts with a phishing email containing a ZIP archive and a malicious Ukrainian-language document, which triggers a loader called BadPaw