Head Mare

Head Mare is a pro-Ukraine intrusion set that has evolved from being described as a hacktivist group into an APT-class actor based on sustained operations, custom malware development, and increasingly sophisticated tradecraft. The group is also tracked as Rainbow Hyena. Its activity has focused primarily on Russian organizations, with some reporting also placing Belarus in scope. Known targeting includes government and public-sector entities as well as organizations in aerospace, defense-adjacent manufacturing, electronics, instrumentation, transportation, energy, information technology, software development, logistics, finance, and other industrial sectors. Head Mare has used multiple initial access vectors, including spearphishing, exploitation of public-facing applications, abuse of trusted relationships and contractors, and use of compromised mail infrastructure to distribute malicious lures. In 2024 and 2025 reporting, the group was linked to phishing campaigns delivering custom malware and to exploitation of vulnerabilities in products such as WinRAR, Microsoft Exchange, and especially TrueConf Server. By 2026, Head Mare was repeatedly observed exploiting TrueConf Server vulnerabilities to obtain unauthenticated code execution and SYSTEM-level access, deploy a web shell, access the TrueConf database, and replace legitimate client installers with trojanized versions. This created a supply-chain-style infection path in which downstream users connecting to compromised servers could receive malicious software. The group’s malware arsenal includes PhantomCore, PhantomGraph, PhantomHeart, PhantomRemote, PhantomJitter, PhantomProxyLite, PhantomRAT, and CobInt. PhantomCore has been used as a backdoor for remote command execution, reconnaissance, persistence, and credential access, including LSASS memory dumping. PhantomGraph has been deployed as a modular backdoor installed as Windows services and has used Microsoft OneDrive as a command-and-control channel. PhantomHeart and PhantomProxyLite reflect a stronger living-off-the-land approach centered on native PowerShell and OpenSSH components, including reverse SSH tunneling for covert access and pivoting. Earlier reporting also tied Head Mare to PhantomRemote delivery through phishing and to PhantomJitter in intrusions overlapping with the group Twelve. Observed post-compromise behavior includes reconnaissance, credential theft, persistence through Windows services, scheduled tasks, COM hijacking, and creation of privileged local accounts; use of reverse SSH tunnels and proxy tooling for lateral movement and remote access; selective data exfiltration; and extensive defense evasion through masquerading, service removal, and event log clearing. In some 2024 intrusions, researchers assessed that Head Mare likely cooperated with Twelve, citing shared tooling, infrastructure, and overlapping victimology. Those operations also culminated in deployment of LockBit 3.0 on Windows systems and Babuk on NAS devices, indicating that at least some Head Mare-linked campaigns combined espionage, disruption, and extortionary or destructive effects. Although public reporting has at times labeled Head Mare as hacktivist, the dominant pattern is a politically aligned, pro-Ukraine actor conducting sustained intrusions against Russian interests with custom malware, credential theft, tunneling, exploitation of exposed services, and occasional ransomware-associated impact. Attribution to Ukraine is supported in multiple reports, but the precise degree of state direction is not publicly established.