Head Mare
Head Mare is a threat actor group with an ideological motive, tracked by Brandefense. It targets organisations in Russia. It uses 9 MITRE ATT&CK techniques.
- Techniques
- 9
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
About Head Mare.
Head Mare is a hacktivism focussed threat actor group known for targeting Russia and Belarus sectors using a remote access malware called PhantomRAT. They have been observed executing malicious code through specially crafted RAR archives, different from previous attacks exploiting vulnerabilities. The attribution of their campaign to Ukraine is uncertain due to limited visibility inside Russian networks. PhantomCore's use of RAR archives in their attack chain has been previously observed in other threat actor groups like Forest Blizzard.
Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.