Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-21509 | 7.8 | 72.5% | ✅ listed | available | 74.45 (High) |
| CVE-2015-1701 | 7.8 | 56.2% | ✅ listed | available | 76.83 (High) |
New APT28 Campaign Targets Ukraine with BadPaw and MeowMeow
ClearSky Security has identified a new APT28 (Fancy Bear) campaign targeting Ukrainian organizations, built around two novel .NET malware strains: BadPaw, a loader, and MeowMeow, a backdoor. The delivery mechanism is a phishing ZIP archive containing an HTA file that lures victims with a Ukrainian border-crossing appeal.
The campaign leverages CVE-2026-21509, a Microsoft Office vulnerability with a CVSS score of 7.8 (v3.1) and an EPSS probability of 72.5% (99th percentile). The CVE is listed in CISA’s Known Exploited Vulnerabilities catalog and has a public proof-of-concept available. It allows an unauthorized attacker to bypass a security feature locally by relying on untrusted inputs in a security decision. APT28 has also been seen using the older CVE-2015-1701, a Win32k.sys kernel-mode driver privilege escalation in Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2, which carries the same CVSS 7.8 score and a 56.2% EPSS probability.
The Phishing Lure: Ukrainian Border-Crossing Appeals
The initial lure is a ZIP archive containing a single HTA file. The HTML Application is themed around a Ukrainian border-crossing appeal, a social-engineing payload tailored to the target profile. Victims open the HTA file, which executes the BadPaw loader and hands off to the MeowMeow backdoor.
BadPaw: The .NET Loader
BadPaw is a .NET loader that executes immediately after the HTA lure runs. It handles the initial download and staging of the MeowMeow backdoor, bridging the gap between the victim's double-click and the full C2 implant.
The loader is written in C# and compiled as a .NET assembly. It fetches the MeowMeow payload from a remote endpoint, writes it to disk, and executes it in the same process context. This keeps the backdoor out of the initial HTA execution path, reducing the chance that the victim's shell sees the full implant in one step.
MeowMeow: The Backdoor
MeowMeow is a .NET backdoor that BadPaw deploys after the initial HTA execution. It provides APT28 with persistent access and full C2 functionality on the victim's host.
The backdoor is written in C# and compiled as a .NET assembly. Once BadPaw fetches it from the remote endpoint and writes it to disk, MeowMeow runs in the same process context as the loader. This keeps the C2 implant out of the initial double-click path, so the victim's shell doesn't see the full implant in one step.
CVE-2026-21509: The Office Bypass
CVE-2026-21509 is the vulnerability doing the heavy lifting in this campaign. It sits in Microsoft Office and lets an unauthorized attacker bypass a security feature locally by relying on untrusted inputs in a security decision. The CVSS 3.1 score is 7.8, and the EPSS probability sits at 72.5% in the 99th percentile, which puts it in the top 1% of actively exploited CVEs. CISA has it in the Known Exploited Vulnerabilities catalog, and a public proof-of-concept is available.
APT28 has also been seen pairing it with CVE-2015-1701, the Win32k.sys kernel-mode driver privilege escalation that has been in the wild since April 2015. That one covers Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2, and it carries the same 7.8 CVSS score with a 56.2% EPSS probability. The two together give APT28 a local security bypass into a kernel-mode privilege escalation, a classic pairing for the group.
CVE-2015-1701: The Win32k EoP
CVE-2015-1701 is the kernel-mode privilege escalation that APT28 has been running since April 2015. It lives in Win32k.sys, the kernel-mode driver in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2, and lets a local user gain privileges through a crafted application. The CVSS 3.1 score is 7.8, and the EPSS probability sits at 56.2% in the 99th percentile. CISA has it in the Known Exploited Vulnerabilities catalog, and a public proof-of-concept is available.
Key points
- ClearSky Security identifies a new APT28 campaign targeting Ukraine with two novel .NET malware strains: BadPaw (loader) and MeowMeow (backdoor).
- Delivery is via a phishing ZIP containing an HTA lure themed around Ukrainian border-crossing appeals.
- BadPaw acts as the initial loader; MeowMeow is the backdoor that provides persistent access.
- The campaign is part of APT28's ongoing activity against Ukrainian government and military targets.
- Both malware components are written in .NET, consistent with APT28's recent tooling trends.