Head Mare

☆ pin

Reports

First seen

Aug 8, 2026

Last seen

Aug 11, 2026

Motivation

Espionage, Hacktivism

Targeting

Sectors

Other ×3

Victim regions

×3

Russia×3

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1505.003 Web Shell ×3T1190 Exploit Public-Facing Application ×3T1219 Remote Access Software ×2T1003 OS Credential Dumping ×2T1041 Exfiltration Over C2 Channel ×1T1055 Process Injection ×1T1574.002 Hijack Execution Flow – DLL Side-Loading ×1T1059.003 Windows Command Shell ×1T1003.001 OS Credential Dumping – LSASS Memory ×1T1543 Create or Modify System Process ×1T1059 Command and Scripting Interpreter ×1T1059.001 PowerShell ×1

Indicators

filename ×25hash_md5 ×20domain ×10ip_v4 ×5cve ×2registry_key ×2url ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-3502 (exploited)

Recent reports

Critical

Head Mare

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Head Mare APT exploits TrueConf vulnerabilities to deploy PhantomCore and PhantomGraph backdoors

Head Mare and Chinese APT Exploit TrueConf and ViPNet Flaws to Deploy Backdoors in Russian Organizations

Head Mare exploits TrueConf vulnerabilities to trojanize client installers with backdoors