Malware

PhantomCore

According to Cyble, PhantomCore is a backdoor utilized by the hacktivist group Head Mare. It has been active since 2023 and is known for consistently targeting Russia. PhantomCore collects the victim’s information, including the public IP address, to gain detailed insights into the target before deploying the final-stage payload or executing additional commands on the compromised system. PhantomCore is known to deploy ransomware payloads such as LockBit and Babuk, inflicting significant damage on the victim’s systems.

Indicators of Compromise 4

Filename SysExcSvc.dll Filename SysReadSvc.dll Filename \public\js\locale.php IP TCP port 4307

MITRE ATT&CK TTPs 6

T1003.001
LSASS Memory
Credential Access
 T1059.001
PowerShell
Execution
 T1078
Valid Accounts
Defense Evasion
 T1105
Ingress Tool Transfer
Command And Control
 T1566
Phishing
Initial Access
 T1571
Non-Standard Port
Command And Control

Source Articles

Hackers breach TrueConf to trojanize client installers with backdoors
The hacktivist group Head Mare breached unpatched TrueConf video conferencing servers to replace legitimate client installers with trojanized versions delivering the PhantomCore and PhantomGraph backdoors. Attackers exploited vulnerabilities in TrueConf Server, including CVE-2026-3502, to gain unauthorized access, execute arbitrary code, and deploy web shells for persistent access. The malicious installers are distributed to organization members and third parties connecting to compromised servers, enabling credential theft via LSASS memory dumping and remote command execution through a OneDrive-based C2 channel.
bleeping-computer ·3h ago