Head Mare
Pro-Ukraine hacktivist collective, self-announced on social media (X) in 2023; reclassified by Kaspersky in August 2026 as an advanced persistent threat (APT) following a July 2026 TrueConf Server zero-day supply-chain campaign. Kaspersky has also documented Head Mare coordinating with another pro-Ukraine hacktivist cluster, Twelve, against shared Russian targets. · Began as geopolitically-motivated hacktivism/retaliation tied to the Russo-Ukrainian conflict, combined with extortion and reputational damage. Kaspersky's 2026 reclassification notes a shift toward 'sophisticated TTPs and absence of destructive activity,' suggesting a possible move toward longer-term intelligence collection alongside the original disruptive aims.
Tactics, Techniques & Procedures (TTPs)
- Earlier campaigns (2023-2024): phishing emails with malicious RAR archives exploiting CVE-2023-38831; Sliver C2; ngrok/rsockstun tunneling; Mimikatz; deployed a LockBit 3.0 variant against Windows and a Babuk variant against Linux/ESXi
- July 2026 campaign: exploited two zero-days in TrueConf Server (KLCERT-26-057, KLCERT-26-058) — unauthenticated access to TCP port 4307, sandbox code execution, then sandbox escape to SYSTEM-level privilege
- Web shell persistence by overwriting TrueConf's public/js/locale.php
- Supply-chain compromise: substituted legitimate TrueConf Client installers on the compromised server with trojanized, unsigned versions
- PhantomCore backdoor delivered via trojanized installer, persistence via COM hijacking
- PhantomGraph two-component implant using Microsoft OneDrive accounts as a C2 channel; observed LSASS memory dumping, host/user enumeration, and reverse SSH tunneling
- Custom PhantomDL and PhantomCore backdoors (likely obfuscated with Garble); persistence through Run keys and scheduled tasks named like Microsoft components (e.g. "MicrosoftUpdateCore")
- Meterpreter, nssm, a PowerShell Sherlock script, the p0wny@shell PHP web shell, XenAllPasswordPro and Mimikatz; LockBitLite and LockBitHard variants used for double encryption
- 2026: PhantomCore COM-hijack persistence (HKCU CLSID InprocServer32), PhantomGraph (SysExcSvc.dll with C2 over OneDrive and SysReadSvc.dll), LSASS dumping via comsvcs.dll, a rootkit and an ELF backdoor using GitHub for C2; trojanized installer named trueconf_windows_update.exe
Known Targets
Analyst Notes
Kaspersky's APT reclassification (August 2026) was triggered specifically by the TrueConf campaign's use of two previously unknown vulnerabilities, a sandbox-escape chain, and a self-contained software-supply-chain compromise. TrueConf patched the exploited flaws 18 June 2026, but Kaspersky telemetry showed continued exploitation of unpatched servers into July. Campaign victims are confined to Russia; a separate, unrelated suspected Chinese-nexus actor exploited a different TrueConf zero-day (CVE-2026-3502) around the same period, not attributed to Head Mare. Update (research pass): the TrueConf patch date (18 June 2026; versions 5.3.9, 5.4.9, 5.5.5) is confirmed by Kaspersky; the Kaspersky ICS-CERT alert is dated 12 August 2026. Securelist's 2023 date is the group's first appearance on X (a 2022 date in the report is an infrastructure date), and Securelist cautions about trusting the group-linked X account. The Twelve link comes from Kaspersky's 2025 report and is not tied to the 2026 campaign. Securelist lists no ATT&CK IDs; those below are the site's own mapping.