Head Mare and Twelve join forces to attack Russian entities

This report analyzes September 2024 attacks on Russian companies by hacktivist group Head Mare, documenting use of known and new tools (PhantomJitter, CobInt), exploitation vectors (phishing, CVE-2021-26855 ProxyLogon, CVE-2023-38831), tunneling and persistence techniques (cloudflared, Gost, Localtonet, NSSM), credential theft and AD dumping, data exfiltration with rclone, and final-stage encryption using LockBit 3.0 and Babuk; overlaps in tools and C2 infrastructure (360nvidia.com, 45.156.27.115) suggest collaboration with the Twelve group and provide a set of IOCs and mitigations for defenders.