Russian APT Campaign Targets Ukraine with BadPaw and MeowMeow Malware

Securityaffairs.Co

Russian APT Campaign Targets Ukraine with BadPaw and MeowMeow Malware

First seen 5 Mar 2026, 16:14 UTC • •36.8

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

A Russian cyber campaign has been identified targeting Ukrainian organizations using new malware families, BadPaw and MeowMeow, delivered via phishing emails. The operation begins with emails containing links to ZIP archives, leveraging a Ukrainian email service to enhance credibility.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

Timeline

2026-03-04

Infosecurity-Magazine reports on BadPaw malware campaign

2026-03-05

Securityaffairs.Co publishes details on BadPaw and MeowMeow

More articles in this cluster (4)

Threat Graph

19 entities, 48 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (4)

APT28
Blue Delta
Fancy Bear
Forest Blizzard

Technique (8)

Malware
Phishing
T1027 - Obfuscated Files Or Information
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interpreter
T1071 - Application Layer Protocol
T1112 - Modify Registry
T1497 - Virtualization/Sandbox Evasion

Malware (2)

BadPaw
MeowMeow

Affected Platform (1)

Windows

Tool (4)

Fiddler
OllyDbg
Procmon
Wireshark

Relationships

APT28 uses BadPaw
APT28 uses MeowMeow
Blue Delta uses BadPaw
Blue Delta uses MeowMeow
Fancy Bear uses BadPaw
Fancy Bear uses MeowMeow
Forest Blizzard uses BadPaw
Forest Blizzard uses MeowMeow
APT28 uses Fiddler
APT28 uses OllyDbg
APT28 uses Procmon
APT28 uses Wireshark
Blue Delta uses Fiddler
Blue Delta uses OllyDbg
Blue Delta uses Procmon
Blue Delta uses Wireshark
Fancy Bear uses Fiddler
Fancy Bear uses OllyDbg
Fancy Bear uses Procmon
Fancy Bear uses Wireshark
Forest Blizzard uses Fiddler
Forest Blizzard uses OllyDbg
Forest Blizzard uses Procmon
Forest Blizzard uses Wireshark
APT28 uses Malware
APT28 uses Phishing
APT28 uses T1027 - Obfuscated Files Or Information
APT28 uses T1053 - Scheduled Task/Job
APT28 uses T1059 - Command and Scripting Interpreter
Blue Delta uses Malware
Blue Delta uses Phishing
Blue Delta uses T1027 - Obfuscated Files Or Information
Blue Delta uses T1053 - Scheduled Task/Job
Blue Delta uses T1059 - Command and Scripting Interpreter
Fancy Bear uses Malware
Fancy Bear uses Phishing
Fancy Bear uses T1027 - Obfuscated Files Or Information
Fancy Bear uses T1053 - Scheduled Task/Job
Fancy Bear uses T1059 - Command and Scripting Interpreter
Forest Blizzard uses Malware
Forest Blizzard uses Phishing
Forest Blizzard uses T1027 - Obfuscated Files Or Information
Forest Blizzard uses T1053 - Scheduled Task/Job
Forest Blizzard uses T1059 - Command and Scripting Interpreter
APT28 related to T1071 - Application Layer Protocol
APT28 related to T1112 - Modify Registry
APT28 related to T1497 - Virtualization/Sandbox Evasion
APT28 related to Windows

Following this threat?

Track APT28 and BadPaw in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that…

UAC-0099 Targets Ukrainian Government with ASHVEIN Malware The Russia-aligned threat actor UAC-0099 has been linked to a new .NET infostealer and RAT named ASHVEIN, targeting Ukrainian government personnel. This malware, also referred to as 'TelemetryBrowser,' features capabilities such as credential theft from Chrome and Firefox, screenshot capture, and remote shell…