Head Mare: adventures of a unicorn in Russia and Belarus

Kaspersky documents the activities of the hacktivist group Head Mare, which targets organizations in Russia and Belarus using phishing that exploits CVE-2023-38831 (WinRAR) to deliver custom malware (PhantomDL/PhantomCore) and publicly available tools (Sliver, Mimikatz, ngrok), culminating in LockBit (Windows) and Babuk (ESXi) ransomware deployment; the report provides TTPs, persistence and evasion methods, C2 infrastructure analysis, and extensive IOCs (hashes, IPs, file paths, URLs).