Intensifies Attacks On Russia With PhantomCore

Tags

External References

• https://cyble.com/
• https://otx.alienvault.com/

Description

The Head Mare hacktivist group has escalated its campaign against Russian targets using the PhantomCore backdoor. The group employs deceptive ZIP archives containing malicious LNK files and executables disguised as archive files to deploy PhantomCore. This C++-compiled backdoor, which replaces earlier GoLang versions, incorporates the Boost.Beast library for C&C communication. PhantomCore gathers victim information and awaits further commands from the C&C server. The infection chain involves PowerShell commands to extract and execute the malware. Head Mare's campaign spans various industries and may deploy ransomware like LockBit and Babuk. The group's evolving tactics and ability to collect data and deploy additional payloads highlight the ongoing threat to Russian organizations.

Date