Headlace
HeadLace is a multi-component backdoor malware family associated with the Russian GRU-linked threat actor APT28 (also tracked as Fancy Bear, Forest Blizzard, BlueDelta, and Unit 26165). Public reporting describes it as a CMD/VBS/BAT-based backdoor used in espionage campaigns from at least 2023 onward. It has been delivered primarily through spearphishing and phishing campaigns, including malicious ZIP archives, lure documents, and phishing emails crafted in victims’ native languages. Reported delivery chains have abused free and legitimate web services such as Mocky.IO/run.mocky.io, webhook.site, InfinityFree, and other cloud or web platforms to redirect victims, host payloads, and distribute commands.
HeadLace has been used for persistence, reconnaissance, credential collection, and data exfiltration. Reported commanding mechanisms include web endpoints on Mocky.IO. ANSSI reported that commands delivered through Mocky.IO were used to gather login credentials, collect information about the victim information system, and deploy offensive tools; persistence could include creation of a scheduled task. CERT Polska described an infection chain matching previously documented HeadLace behavior in which a ZIP archive contained a decoy executable, a BAT script, and a malicious WindowsCodecs.dll used for DLL side-loading. Subsequent stages abused Microsoft Edge, including headless mode, to fetch and execute additional scripts from webhook.site in a recurring loop, while displaying decoy images to reduce suspicion. The final observed stage collected the public IP address via ipinfo.io and directory listings from user and program folders, then sent the data to a command-and-control endpoint.
Victimology in the provided reporting includes critical energy infrastructure in Ukraine, Polish government institutions, French entities, European governmental and diplomatic targets, research and policy-focused organizations, logistics entities, technology companies, and organizations involved in humanitarian aid allocation or aid delivery to Ukraine. IBM X-Force reported a December 2023 campaign using Israel-Hamas-war-themed lure documents derived from authentic academic, finance, diplomatic, government, educational, and NGO materials to deliver the HeadLace backdoor, with country-based filtering restricting malware delivery to intended victims. Joint government advisories also state that HEADLACE was used in the ongoing GRU campaign against Western logistics entities and technology companies supporting Ukraine, where it was used alongside MASEPIE for persistence and data exfiltration.
High-confidence infrastructure and behavioral indicators mentioned in the content include use of Mocky.IO/run.mocky.io and webhook.site in delivery and command distribution, malicious ZIP archives, DLL side-loading via a fake WindowsCodecs.dll, BAT/VBS/CMD script chains, scheduled-task persistence, Microsoft Edge headless execution, and host reconnaissance including public IP discovery through ipinfo.io.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The Russian GRU cyber campaign also involves malware such as HEADLACE and MASEPIE, which are used for persistence and data exfiltration.
The Russian GRU cyber campaign also involves malware such as HEADLACE and MASEPIE, which are used for persistence and data exfiltration.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For example, on September 4, 2023, CERT-UA reported a phishing campaign in which BlueDelta leveraged Headlace information-stealing malware to target critical energy infrastructure in Ukraine.
The Russian GRU cyber campaign also involves malware such as HEADLACE and MASEPIE, which are used for persistence and data exfiltration.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
2 techniques
Initial Access
A significant aspect of the campaign involves the exploitation of known vulnerabilities. The actors have weaponized multiple CVEs, including: CVE-2023-23397 in Microsoft Outlook to harvest credentials Roundcube vulnerabilities for email server access CVE-2023-38831 in WinRAR for remote code execution
In December 2023, Ukraine’s Computer Emergency Response Team (CERT-UA) reported that Russian state cyber unit APT28 was targeting entities in Ukraine and Poland with phishing campaigns... On September 4, 2023, CERT-UA reported a phishing campaign in which BlueDelta leveraged Headlace information-stealing malware to target critical energy infrastructure in Ukraine.
Execution
4 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-component backdoor implemented through CMD, VBS, and BAT components as part of APT28's short-lived modular arsenal.
Malware used in the campaign for persistence and data exfiltration.
HeadLace is a malware used by APT28 for credential harvesting, particularly targeting users of webmail services like UKR[.]net. It is deployed as part of phishing campaigns to steal login credentials and two-factor authentication codes.
A targeted backdoor delivered via lure documents themed around the Israel–Hamas war; infrastructure appears to geofence delivery so only intended victims in a specific country can download/receive the payload, enabling multiple malicious actions on objectives.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.