Head Mare — APT Profile
Head Mare is a pro-Ukrainian intrusion set that has attacked organizations in Russia and Belarus since 2023, when, according to Kaspersky, it first made itself known through an account on X. Kaspersky profiled it in September 2024 as a hacktivist operation that stole data and then encrypted victims using builds from the leaked LockBit and Babuk builders, and in March 2025 tied it to the Twelve group through shared command servers and the CobInt backdoor. Its operations now run on a large custom toolset, the Phantom family, which includes the PhantomCore backdoor, the PhantomDL loader, the PhantomRemote backdoor and the PhantomGraph backdoor that uses a Microsoft OneDrive account for command and control. Kaspersky redesignated the group an APT in August 2026, citing the sophistication of its tradecraft and the absence of destructive activity rather than any state nexus, after it chained two TrueConf server flaws on an unpatched server to replace legitimate TrueConf client installers with trojanized builds served to conference participants. Vendors still disagree on the label: Positive Technologies tracks the same cluster as PhantomCore, calls it cyberespionage against Russian critical infrastructure and reported in April 2026 that the operators were in some incidents still encrypting virtual machines, servers and workstations with LockBit 3.0, while Intrinsec assessed it in November 2025 as a hacktivist intrusion set aligned with Ukraine's interests and BI.ZONE tracks it as Rainbow Hyena. F6 documented a further campaign in April 2026 in which malicious emails impersonating Russia's foreign ministry, using a North Korean delegation visit as the lure, delivered a new remote access trojan it named KermitRAT.Also tracked as
PhantomCore, Rainbow Hyena
IntelFusions coverage (1)
- Hackers backdoor TrueConf servers to infect meeting guests 2026-08-11 · Nation-State
Tools & malware
- ADRecon Network Reconnaissance
- Babuk Ransomware
- cloudflared Tunneling Tool
- CobInt Backdoor
- DumpIt Credential Harvesting
- fscan Network Reconnaissance
- Gost Tunneling Tool
- KermitRAT Remote Access Trojan
- Localtonet Tunneling Tool
- LockBit Ransomware
- MacTunnelRat Tunneling Tool
- MemProcFS Credential Harvesting
- MeshAgent Remote Access Tool
- Mimikatz Credential Harvesting
- mRemoteNG Remote Access Tool
- ngrok Tunneling Tool
- NSSM Tool
- PhantomCore Backdoor
- PhantomDL Loader
- PhantomGraph Backdoor
- PhantomJitter Backdoor
- PhantomProxyLite Tunneling Tool
- PhantomRAT Backdoor
- PhantomRemote Backdoor
- PhantomRShell Backdoor
- PhantomSscp Tunneling Tool
- PhantomStealer Infostealer
- PhantomTaskShell Backdoor
- ProcDump Credential Harvesting
- PsExec Remote Execution
- Rclone Exfiltration Tool
- revsocks Tunneling Tool
- rsockstun Tunneling Tool
- RSocx Tunneling Tool
- secretsdump Credential Harvesting
- Sliver Post-Exploitation Framework
- smbexec Remote Execution
- SoftPerfect Network Scanner Network Reconnaissance
- Velociraptor Tool
- wmiexec Remote Execution
- XenAllPasswordPro Credential Harvesting
Vendor research
- Trouble in the air: A spree of campaigns targeting the aerospace industry in Russia Intrinsec
- Скрываясь на виду: как PhantomCore маскирует свою активность с помощью легитимных инструментов Positive Technologies
- Head Mare hacktivists: attacks on companies in Russia and Belarus Kaspersky
- Head Mare delivers PhantomCore and PhantomGraph backdoors via an unpatched TrueConf server Kaspersky
- Phantom pains: a large-scale cyberespionage campaign and a possible split within the PhantomCore APT group Positive Technologies
- Head Mare and Twelve: Joint attacks on Russian entities Kaspersky