PhantomCore
Also known asHead Mare
Summary
Active since January 2024, targeting Russian critical infrastructure exclusively. August 2025 campaign compromised Russian state institutions, research institutes, military-industrial complex enterprises, shipbuilding, chemical/mining/manufacturing, and IT companies. Average dwell time 24 days (max 78 days). At least 49 hosts still under attacker control at time of Positive Technologies report. F6 researchers (May 2025) linked PhantomCore to Head Mare, noting evolution from data theft/destruction (2022-2023) to ransomware encryption operations (2024+). Uses PhantomDL loader written in Go with Garble obfuscation. Infrastructure split 48% Russian / 52% foreign (Finland, France, Netherlands, USA, Germany, Hong Kong, Moldova, Poland — with 33% concentrated at Canadian provider).
Attribution
Kaspersky reclassed Head Mare (aliased here) from hacktivist to APT
Tracked by researchers; no state or organisation has been publicly attributed.
- Positive Technologies (PT ESC) (Research, 2025-09-09)
Tracks a large-scale espionage campaign against Russian organisations - Kaspersky (Research, 2026-08-07)
Head Mare, which delivers the PhantomCore backdoor, is now counted among APT groups rather than hacktivists; Kaspersky does not equate it with PT's PhantomCore
Campaigns 4
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution1 | T1203Exploitation for Client Execution |
| Stealth1 | T1027Obfuscated Files or Information |
| Impact2 | T1486Data Encrypted for ImpactT1485Data Destruction |
Malware and tools 6
| Name | Description | Platform |
|---|---|---|
| PhantomDL/PhantomGoDownloader | Go Loader | Windows |
| PhantomCore Implant | Backdoor | Windows |
| PhantomPxPigeon | Trojanized TrueConf client / reverse-shell backdoor | Windows |
| MacTunnelRat (PhantomHeart) | Reverse SSH tunnel tool (PowerShell) | Windows |
| PhantomSscp | Reverse SSH tunnel tool (DLL) | Windows |
| PhantomProxyLite | Reverse SSH tunnel tool (PowerShell) | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2023-38831 | 7.8 | WinRAR (KEV 2023-08-24) |
Highest CVSS first.
Infrastructure patterns
- Servers ~48% in Russia, 52% abroad; a third on Canadian provider CGI Global Limited (Positive Technologies, 2025)
- Function-segmented Ubuntu VPSs; reverse SSH tunnels into victims disguised as HTTPS (Positive Technologies, 2025)
Reporting and advisories 3
- Positive Technologies PT ESC
Russian CNI Summer Campaign - Positive Technologies PT ESC
TrueConf Server exploitation chain (BDU:2025-10114/-10115/-10116) - Kaspersky
Head Mare TrueConf-client trojanization — PhantomPxPigeon / PhantomCore / PhantomGraph (Kaspersky)