File · Head Mare · Unknown · misp-galaxy · refreshed 2026-10-06
Head Mare
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- —todaynew CVE1 new CVE: CVE-2023-38831
Analyst brief
misp-galaxyHead Mare is a hacktivism focussed threat actor group known for targeting Russia and Belarus sectors using a remote access malware called PhantomRAT. They have been observed executing malicious code through specially crafted RAR archives, different from previous attacks exploiting vulnerabilities. The attribution of their campaign to Ukraine is uncertain due to limited visibility inside Russian networks. PhantomCore's use of RAR archives in their attack chain has been previously observed in other threat actor groups like Forest Blizzard.
CVEs Head Mare is cited as exploiting
none on KEV- CVE-2023-388312026-10-17
“However, unlike other similar groups, Head Mare uses more up-to-date methods for obtaining initial access. For instance, the attackers took advantage of the relatively recent CVE-2023-38831 vulnerability in WinRAR, which allows the attacker to execute arbitrary code on the system via a specially prepared archive.”
cited as exploiting · source: securelist.com ↗ · 2026-10-17
“They use up-to-date tactics, such as exploiting the CVE-2023-38831 vulnerability in WinRAR, to gain initial access and deliver malicious payloads.”
cited as exploiting · named nearby · source: cyble.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
4 sourcesTrack Head Mare on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.