Head Mare
Reports
4
First seen
Aug 8, 2026
Last seen
Aug 21, 2026
Motivation
Espionage, Hacktivism
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
×3×3
Russia×3
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1190 Exploit Public-Facing Application ×4T1505.003 Web Shell ×3T1219 Remote Access Software ×2T1003 OS Credential Dumping ×2T1071.001 Application Layer Protocol: Web Protocols ×1T1041 Exfiltration Over C2 Channel ×1T1055 Process Injection ×1T1195.002 Compromise Software Supply Chain ×1T1574.002 Hijack Execution Flow – DLL Side-Loading ×1T1059.003 Windows Command Shell ×1T1003.001 OS Credential Dumping – LSASS Memory ×1T1543 Create or Modify System Process ×1
Indicators
filename ×25hash_md5 ×20domain ×10cve ×5ip_v4 ×5registry_key ×2url ×1
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
Critical