MeowMeow
MeowMeow is a previously undocumented backdoor reported by ClearSky as part of a Russia-linked phishing campaign targeting Ukrainian organizations and entities. In the observed intrusion chain, victims received phishing emails, including messages sent from ukr[.]net-hosted addresses, that linked to a ZIP archive containing a Ukrainian-language lure related to border-crossing permits or appeals. The archive launched an HTA-based infection chain that ultimately delivered the .NET-based BadPaw loader, which established command-and-control communications and then deployed MeowMeow.
MeowMeow is described as a sophisticated backdoor used for cyberespionage. Reported capabilities include access to infected systems, remote execution of PowerShell commands, file enumeration, checking whether specific files exist, and reading, writing, and deleting local files or data. The malware includes anti-analysis and environmental-awareness features: it checks for virtual machines and common analysis or monitoring tools including Wireshark, ProcMon/Procmon, Fiddler, and in some reporting Ollydbg, and terminates if it detects a sandbox or researcher environment. MeowMeow’s malicious functionality is also described as parameter-gated in the infection chain, activating only when executed with a specific parameter.
ClearSky reported that both BadPaw and MeowMeow were obfuscated with the .NET Reactor packer/obfuscator to hinder static analysis and reverse engineering, and that the broader campaign used stealth features such as sandbox evasion and staged delivery. The activity was attributed with high confidence to a Russia-linked or Russian state-aligned cyberespionage actor, and with lower or moderate confidence specifically to APT28 (Fancy Bear, Forest Blizzard, Blue Delta), based on Ukrainian targeting, geopolitical lures, Russian-language code artifacts, and tradecraft overlap with prior Russian operations. The reporting did not identify specific victim organizations or confirm attack success.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BadPaw then facilitates the subsequent installation of the advanced MeowMeow backdoor, which has file enumeration and data reading, writing, and deletion capabilities.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
6 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
Discovery
3 techniques
Discovery
Command and Control
2 techniques
Command and Control
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newly reported malware family used in a phishing campaign targeting Ukrainian organizations.
One of a newly reported malware pair used in a Russian campaign targeting Ukraine.
Russian APT targets Ukraine with BadPaw and MeowMeow malware
A backdoor deployed by the BadPaw loader after C2 is established.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.