PhantomCore
Web3 / compliance
PhantomCore (also tracked as Head Mare and Fairy Trickster) is a politically motivated, pro-Ukrainian hacktivist group highly active in attacking Russian entities since late 2023 and throughout 2025–2026. Unlike financially motivated ransomware groups, PhantomCore's primary objectives are data theft, strategic disruption, and psychological impact on Russian organisations — making payment demands secondary to the goal of causing maximum operational damage. The group specialises in breaching Russian corporate and government networks, frequently exploiting vulnerabilities in widely used Russian software such as the TrueConf video-conferencing platform, and has targeted organisations across Russian aerospace, logistics, media, and government sectors. While PhantomCore does deploy ransomware (commonly using repurposed leaked encryptors from Babuk and LockBit), the ransomware component is typically used as a cover or additional harassment mechanism rather than the primary revenue model — the group frequently wipes data rather than offering genuine decryption, and does not consistently pursue payment collection. Example: PhantomCore's 2025 campaign against a Russian regional logistics operator combined a TrueConf exploitation for initial access with lateral movement to industrial control systems, data exfiltration of client shipment records, followed by LockBit-derived ransomware deployment and data wiping — causing weeks of operational disruption with no decryption key ever provided, regardless of payment. Why it matters for compliance: PhantomCore illustrates the growing category of ideologically motivated cyber threat actors targeting the Russia-Ukraine conflict perimeter, where ransomware is a weapon of disruption rather than a revenue mechanism. Web3 firms with Russian-market exposure or infrastructure hosted in conflict-adjacent jurisdictions must factor geopolitically motivated sabotage — not just financial extortion — into their threat models.
Explore the full Web3 Glossary — 2,062+ expert-curated definitions. Need guidance? Talk to our consultants.