ClearSky report on BadPaw and MeowMeow Russian malware

ClearSky researchers describe a March 2026 Russian-aligned cyber campaign against Ukrainian targets that uses phishing to deliver a ZIP/HTA infection chain which extracts a .NET loader (BadPaw) via steganography and then retrieves a persistent backdoor (MeowMeow). Both binaries are protected with .NET Reactor and require specific runtime parameters to activate malicious functionality; they include extensive sandbox and tooling checks, C2 callbacks to virtualdailyplanner.pro, and delivered artifacts/hashes and indicators for detection and response.