UnclassifiedIdeologyAdvanced sophistication
PhantomCore
PhantomCore is a threat actor group with an ideological motive, tracked by Brandefense. It targets 14 sectors, including Government and Technology, in Russia and Belarus. It uses 23 MITRE ATT&CK techniques and exploits 2 known CVEs.
Also known as
- Fairy Trickster
- Rainbow Hyena
- Techniques
- 23
- Exploited CVEs
- 2
- First seen
- Nov 28, 2025
- Last seen
- Nov 28, 2025
- Record updated
Who They Target.
About PhantomCore.
Hacking group targeting Russian organizations to harvest sensitive information and deliver additional payloads.
Last updated Sep 21, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.