A new cyber campaign attributed to the Russian state-affiliated group APT28 has been detected targeting organizations in Ukraine. Security researchers from ClearSky recently published findings revealing the use of two previously undocumented malware families—BadPaw and MeowMeow—deployed in a coordinated attack chain aimed at compromising sensitive systems and gaining persistent access to networks.
The attack begins with highly targeted phishing emails. These messages contain links to ZIP archives, which when extracted, deliver an HTA file designed to deceive recipients. The lure document, written in Ukrainian, concerns border crossing appeals, capitalizing on timely geopolitical issues to increase the likelihood that victims will open and execute the malicious file. By leveraging localized content, the attackers improve their chances of bypassing initial skepticism and security awareness among employees.
Upon execution, the HTA file launches BadPaw, a .NET-based loader. BadPaw establishes secure communication with remote command-and-control (C2) servers, enabling the attackers to retrieve and deploy the secondary payload, the MeowMeow backdoor. MeowMeow provides advanced capabilities, including persistent access, system reconnaissance, and the potential for data exfiltration. The backdoor can evade traditional security defenses through obfuscation and stealthy operation, posing significant risks to critical infrastructure and sensitive information in affected organizations.
APT28 is known for conducting highly sophisticated cyber operations, often with political or strategic objectives. The deployment of new malware families, such as BadPaw and MeowMeow, illustrates the group’s evolving tactics and technical capabilities. These attacks are part of a broader trend of cyber threats targeting Ukrainian institutions amid ongoing geopolitical tensions, where cyber operations are increasingly used to gather intelligence, disrupt operations, or exert pressure on key entities.
Researchers emphasize the importance of heightened vigilance, both in technical defenses and employee awareness. Organizations are urged to implement multi-layered security strategies, including advanced email filtering, endpoint protection, network monitoring, and rapid incident response protocols. Training employees to identify phishing attempts and verify suspicious communications is crucial in preventing the initial execution of malware.
Furthermore, monitoring for indicators of compromise associated with BadPaw and MeowMeow, such as unusual network connections or unexpected HTA execution, can help organizations detect infections early. Collaboration with national and international cybersecurity authorities can enhance threat intelligence sharing and enable timely mitigation efforts.
The APT28 campaign serves as a reminder that cyber threats remain dynamic and highly targeted, particularly in regions facing political instability. Organizations in Ukraine and beyond must remain vigilant, update defenses continuously, and adopt proactive measures to safeguard critical systems against sophisticated malware campaigns designed to exploit social engineering and advanced exploitation techniques.
