Head Mare, a hacktivist group targeting Russian and Belarusian organizations, uses the CVE-2023-38831 vulnerability to gain initial access, delivering a malicious payload disguised as an archive, by demanding a ransom for data encryption while publicly posting information about their victims on X.
It leverages a mix of publicly available and proprietary tools in their attacks, including custom malware PhantomDL and PhantomCore for initial access and exploitation, including Lockbit ransomware, Sliver, and other commonly used tools, allowing them to compromise systems and deploy ransomware effectively.
The Head Mare group is using PhantomDL and PhantomCore malware to target Russian organizations, which exploit the CVE-2023-38831 vulnerability in WinRAR to execute malicious code. After infection, the malware establishes communication with command and control servers to gather information about the infected system.
The attackers employed various persistence mechanisms, including adding registry entries and creating scheduled tasks, which ensured the malicious PhantomCore sample would automatically execute upon system startup or user login, facilitating continuous communication with the attacker’s command-and-control server.
They also employed various detection evasion techniques, including disguising their malicious software as legitimate system processes, using double extensions for phishing attachments, and obfuscating malware with Garble.
Sliver as their primary C2 framework, using it to manage compromised systems, execute commands, and gather data by disguising Sliver implants with Garble and using VPS/VDS servers as C2 servers.
The attackers utilized various tools, including PHP shells, Sliver implants, PowerShell scripts, and Meterpreter, on these servers to maintain persistence, escalate privileges, and execute commands.
The rsockstun utility creates secure tunnels between clients and servers using SOCKS5 and Yamux, which support SSL connections, authentication, and proxy server connections, while the utility’s key functions include establishing connections, authenticating, and forwarding traffic.
The attackers gather information about the victim’s domain name, network interfaces, and current user and also search for a scheduled task named “WindowsCore” to potentially exploit or compromise further.
They used mimikatz and XenAllPasswordPro to harvest credentials, then employed LockBit and Babuk ransomware to encrypt files on Windows and ESXi systems, respectively. Babuk’s distinctive features include logging activities and destroying virtual machines, while LockBit used two variants sequentially for enhanced encryption.
The analysis of Head Mare samples by Secure List revealed that they were exclusively detected in Russia and Belarus. Similar malware samples were found to be associated with the PhantomDL, PhantomCore, and LockBit toolkits.
The group uses custom malware and exploits a new vulnerability to infiltrate Russian and Belarusian organizations, demonstrating the evolving and improving threat landscape that these organizations must be aware of.
