Securityaffairs.Co

Russian APT Campaign Targets Ukraine with BadPaw and MeowMeow Malware

First seen 5 Mar 2026, 16:14 UTC • Infosecurity-Magazine

•36.8

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A Russian cyber campaign has been identified targeting Ukrainian organizations using new malware families, BadPaw and MeowMeow, delivered via phishing emails. The operation begins with emails containing links to ZIP archives, leveraging a Ukrainian email service to enhance credibility.

How this analysis works

Timeline

2026-03-04

Infosecurity-Magazine reports on BadPaw malware campaign

2026-03-05

Securityaffairs.Co publishes details on BadPaw and MeowMeow

Attack Flow

19 entities, 48 inferred relationships (STIX 2.1).

Threat Actor (4)

Apt28
Blue Delta
Fancy Bear
Forest Blizzard

Technique (8)

Malware
Phishing
T1027 - Obfuscated Files Or Information
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interpreter
T1071 - Application Layer Protocol
T1112 - Modify Registry
T1497 - Virtualization/Sandbox Evasion

Malware (2)

BadPaw
MeowMeow

Affected Platform (1)

Windows

Tool (4)

Fiddler
OllyDbg
Procmon
Wireshark

Relationships

Apt28 uses BadPaw
Apt28 uses MeowMeow
Blue Delta uses BadPaw
Blue Delta uses MeowMeow
Fancy Bear uses BadPaw
Fancy Bear uses MeowMeow
Forest Blizzard uses BadPaw
Forest Blizzard uses MeowMeow
Apt28 uses Fiddler
Apt28 uses OllyDbg
Apt28 uses Procmon
Apt28 uses Wireshark
Blue Delta uses Fiddler
Blue Delta uses OllyDbg
Blue Delta uses Procmon
Blue Delta uses Wireshark
Fancy Bear uses Fiddler
Fancy Bear uses OllyDbg
Fancy Bear uses Procmon
Fancy Bear uses Wireshark
Forest Blizzard uses Fiddler
Forest Blizzard uses OllyDbg
Forest Blizzard uses Procmon
Forest Blizzard uses Wireshark
Apt28 uses Malware
Apt28 uses Phishing
Apt28 uses T1027 - Obfuscated Files Or Information
Apt28 uses T1053 - Scheduled Task/Job
Apt28 uses T1059 - Command and Scripting Interpreter
Blue Delta uses Malware
Blue Delta uses Phishing
Blue Delta uses T1027 - Obfuscated Files Or Information
Blue Delta uses T1053 - Scheduled Task/Job
Blue Delta uses T1059 - Command and Scripting Interpreter
Fancy Bear uses Malware
Fancy Bear uses Phishing
Fancy Bear uses T1027 - Obfuscated Files Or Information
Fancy Bear uses T1053 - Scheduled Task/Job
Fancy Bear uses T1059 - Command and Scripting Interpreter
Forest Blizzard uses Malware
Forest Blizzard uses Phishing
Forest Blizzard uses T1027 - Obfuscated Files Or Information
Forest Blizzard uses T1053 - Scheduled Task/Job
Forest Blizzard uses T1059 - Command and Scripting Interpreter
Apt28 related to T1071 - Application Layer Protocol
Apt28 related to T1112 - Modify Registry
Apt28 related to T1497 - Virtualization/Sandbox Evasion
Apt28 related to Windows

Continue Reading

APT28 Exploits MSHTML Zero-Day Vulnerability in Windows APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine GRU Compromises Home Routers in 23 States to Steal Outlook Credentials Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Critical RCE Vulnerability in Zimbra Exploited by Attackers Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials

Russian APT Campaign Targets Ukraine with BadPaw and MeowMeow Malware

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading