{"id":4752,"date":"2026-03-07T18:36:54","date_gmt":"2026-03-07T18:36:54","guid":{"rendered":"https:\/\/ft365.org\/index.php\/2026\/03\/07\/multi-stage-badpaw-malware-campaign-targets-ukraine\/"},"modified":"2026-03-07T18:36:54","modified_gmt":"2026-03-07T18:36:54","slug":"multi-stage-badpaw-malware-campaign-targets-ukraine","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2026\/03\/07\/multi-stage-badpaw-malware-campaign-targets-ukraine\/","title":{"rendered":"Multi-Stage “BadPaw” Malware Campaign Targets Ukraine"},"content":{"rendered":"
\n

A newly identified malware campaign leveraging a Ukrainian email service to build credibility has been uncovered by cybersecurity researchers.<\/p>\n

The operation begins with an email sent from an address hosted on ukr[.]net, a popular Ukrainian provider previously abused by the Russian-linked threat actor APT28 in past campaigns.<\/p>\n

According to an\u00a0advisory by researchers at ClearSky,\u00a0\u00a0who have\u00a0named the malware “BadPaw,”\u00a0the attack is triggered when a recipient clicks a link claiming to host a ZIP archive. Instead of initiating a direct download, the victim is\u00a0redirected to a domain that loads a tracking pixel, allowing the attacker to confirm engagement. A second redirect then delivers the ZIP file.<\/p>\n

Although the archive appears to contain a standard HTML file, ClearSky\u00a0researchers found it is actually an HTA application in disguise. Once executed, the file displays a decoy document referencing a Ukrainian government border crossing appeal, while malicious processes run in the background.<\/p>\n

Read more on malware evasion techniques: “Digital Parasite” Warning as Attackers Favor Stealth for Extortion<\/em><\/p>\n

Before proceeding, the malware checks a Windows Registry key to determine the system’s installation date. If the operating system is less than ten days old, execution stops, a tactic designed to avoid sandbox environments used by security analysts.<\/p>\n

If conditions are met, the malware searches for the original ZIP file and extracts additional components. Persistence is achieved through a scheduled task that runs a VBS script, which uses steganography to extract hidden executable code from an image file.<\/p>\n

Only nine antivirus engines detected the payload at the time of analysis.<\/p>\n

Multi-Layered Backdoor and Attribution<\/strong><\/h3>\n

Once activated with a specific parameter, BadPaw connects to a command-and-control (C2) server. The staged communication process includes:<\/p>\n