Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
35 IOCs
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants
Malware Families
Excerpt
Overview of the attack In July 2026, Kaspersky experts detected a new attack by the Head Mare group. Previously, we classified them as hacktivists, but now we define them as an APT group due to the sophistication of their TTPs and the absence of destructive activity (encryption, wiping) in the targeted infrastructures. In this latest campaign, the attackers exploited a chain of vulnerabilities in the TrueConf video conferencing server and replaced the original TrueConf client…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →35 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | aee9642b45b099cb7f3053b9b680b425 | Medium | Score 53/100 | First seen |
| Domain | penzadogshelter.site | High | Score 69/100 | First seen |
| MD5 | 12d4e8f5295f2ef7e0f9bfc0f4830939 | Medium | Score 53/100 | First seen |
| MD5 | 0e79996d9483d1e44fea32b0a48c2c19 | Medium | Score 53/100 | First seen |
| MD5 | 8fcc3e4ccbf1725d9989fb464abf3561 | Medium | Score 53/100 | First seen |
| MD5 | 2bb75c20e778eb5c416965bd4d4259b1 | Medium | Score 53/100 | First seen |
| Domain | cosmetic-deals.store | High | Score 69/100 | First seen |
| MD5 | dd1fd2b459b97b7d59375cb8383cd19a | Medium | Score 53/100 | First seen |
| MD5 | 4d27b4eb1c5dbb3d8160f29b8119523e | Medium | Score 53/100 | First seen |
| Domain | nova-stream.site | Medium | Score 56/100 | First seen |
| MD5 | b3a6fee3307f1c26841fd5c603e2b013 | Medium | Score 53/100 | First seen |
| MD5 | 7f267006cac10f341c356b62fe493527 | Medium | Score 53/100 | First seen |
| IP | 81.177.32.12 | High | Score 69/100 | First seen |
| MD5 | 0e4541c3153ec5ed01497f19cf4f63d0 | Medium | Score 53/100 | First seen |
| MD5 | 748c9f8cb1065000616204935f96207f | Medium | Score 53/100 | First seen |
| MD5 | 489f43be558b2679284ceabed7adc4f3 | Medium | Score 53/100 | First seen |
| MD5 | ee2861d5965e8730708cd1da8a93fa4c | Medium | Score 53/100 | First seen |
| Domain | trendy-market.site | High | Score 69/100 | First seen |
| Domain | flexish.shop | High | Score 69/100 | First seen |
| IP | 38.244.205.244 | High | Score 69/100 | First seen |
| IP | 31.59.102.61 | High | Score 69/100 | First seen |
| MD5 | ec0bf4a2186a88874e9f26f07cfeb532 | Medium | Score 53/100 | First seen |
| Domain | rinomobile.ink | High | Score 69/100 | First seen |
| Domain | bright-deals.site | High | Score 69/100 | First seen |
| MD5 | c3a2abe8756910f42582b04a44ea3514 | Medium | Score 53/100 | First seen |
| Domain | vks.gossopka.forum | High | Score 68/100 | First seen |
| MD5 | 43f435c3c437bc879a2d7d4634f43494 | Medium | Score 53/100 | First seen |
| Domain | urbanpixel.store | High | Score 83/100 | First seen |
| MD5 | c915cb6c2aeb863ee8479238e1644217 | Medium | Score 53/100 | First seen |
| MD5 | 129462164a7d52e9ea8560b60f0412c5 | Medium | Score 53/100 | First seen |
| MD5 | b348642146ea34771e5785c5857950f5 | Medium | Score 53/100 | First seen |
| IP | 194.87.239.71 | High | Score 69/100 | First seen |
| MD5 | c5a460e4e68a088f6e51b2c6474642ec | Medium | Score 53/100 | First seen |
| IP | 194.87.93.153 | High | Score 69/100 | First seen |
| Domain | media-hub.today | High | Score 69/100 | First seen |
IOC Relationship Graph
Building graph…