Loading threat actor…
Head Mare, also tracked as Rainbow Hyena, is a pro-Ukrainian threat group active since at least 2023 that targets organizations in Russia and Belarus. Its targets include transportation, aerospace, defense-related manufacturing, instrumentation, electronics, energy, information technology, and software development. Historically associated with hacktivism and destructive attacks, the group has used LockBit and Babuk ransomware to encrypt victim systems and demand ransom payments. Its July 2026 operations demonstrated sophisticated, persistent intrusions without observed encryption or wiping, leading to its classification as an advanced persistent threat group. Head Mare obtains initial access through phishing, exploitation of public-facing servers, and compromised contractors. Its phishing operations use compromised organizational mail servers, malicious shortcuts, PowerShell, and executable/archive polyglots to distribute backdoors including PhantomPyramid and PhantomRemote. These delivery methods disguise executable content and exploit differences in file interpretation to evade inspection. In 2026, Head Mare chained TrueConf Server vulnerabilities CVE-2026-72529 and CVE-2026-72530 to achieve unauthenticated code execution, escape an isolated execution environment, and obtain SYSTEM privileges. It installed web shells, accessed conferencing databases, collected infrastructure information, deleted exploitation-related logs, and replaced legitimate client installers with packages carrying PhantomCore. This distribution mechanism exposed both employees of compromised organizations and external conference participants. The group maintains access through web shells, Windows services, and COM-based persistence. Its two-component PhantomGraph backdoor uses Microsoft OneDrive for command-and-control, while its Linux tooling includes backdoors using GitHub or the TrueConf protocol. Post-compromise activity includes LSASS memory dumping for credential theft, infrastructure reconnaissance, remote command execution, lateral movement, and reverse SSH tunneling.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
75 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
16 malware families Mallory has associated with this actor across public reporting.
11 additional families tracked in Mallory.
5 CVEs Mallory has associated with this actor across public reporting. 5 of them are exploited in the wild (not necessarily by this actor).
183 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.