Head Mare

ACTIVE CAMPAIGN TRACKED ▲ High Threat Ukraine

Primary Aliases: PhantomCore

Sponsor / State Affiliation pro-Ukrainian (potential links to military intelligence via coordination with BO Team/Black Owl)

Primary Motivation Political hacktivism and strategic intelligence collection targeting Russia and Belarus

Active Timeline Unknown – Present

Confidence Rating 90% (Grounded)

TrueConf Server Poisoning, DPRK Delegation Spear-Phishing, Medical Insurance ClickFix Espionage

⚔️ Weaponized CVE Matrix (1)

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Industrial Energy Transportation Government Military Defense IT and Software Development Healthcare Housing Utilities

🛡️ MITRE ATT&CK® Attack Lifecycle (8 TTPs)

📥 Download Navigator JSON

Initial Access 3

T1566 Exploitation of public-facing software (e.g., TrueConf server vulnerability chaining)

T1566 Supply chain compromise via trojanized software installers

T1566 Spear-phishing using polyglot files and weaponized RAR archives (CVE-2023-38831)

Credential Access & Discovery 2

T1003 ClickFix social engineering (fake CAPTCHAs inducing users to run CLI commands)

T1003 Use of legitimate administrative tools (RClone, MeshAgent, Mimikatz)

Lateral Movement & Collection 1

T1021 Reverse SSH tunneling via PhantomProxyLite

Command & Control 2

T1071 Deployment of custom malware families: PhantomCore, PhantomGraph, PhantomRAT, and PhantomHeart

T1071 C2 communication leveraging legitimate services like Microsoft OneDrive

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Head Mare APT Exploits TrueConf Server Vulnerabilities to Deploy PhantomCore and PhantomGraph

Attacks and Vulnerabilities 2026-08-13

Copied to clipboard

LINK COPIED TO CLIPBOARD