Russian APT targets Ukraine with BadPaw and MeowMeow malware

Researchers uncovered a Russia-linked phishing campaign targeting Ukrainian entities that uses ZIP-delivered HTA lures to deploy a .NET loader called BadPaw and a backdoor named MeowMeow; the malware chain employs steganography, scheduled-task persistence, anti-analysis checks (e.g., InstallDate and VM/tool detection), and .NET Reactor packing, and is attributed with moderate confidence to APT28.