Head Mare
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
Head Mare is a hacktivism focussed threat actor group known for targeting Russia and Belarus sectors using a remote access malware called PhantomRAT. They have been observed executing malicious code through specially crafted RAR archives, different from previous attacks exploiting vulnerabilities. The attribution of their campaign to Ukraine is uncertain due to limited visibility inside Russian networks. PhantomCore's use of RAR archives in their attack chain has been previously observed in other threat actor groups like Forest Blizzard.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://therecord.media/russian-researchers-winrar-bug-ukraine-espionage
https://www.facct.ru/blog/phantomdl-loader
https://securelist.com/head-mare-hacktivists/113555/
https://cyble.com/blog/head-mare-deploys-phantomcore-against-russia/