Threat Profile
| Attribute | Details |
|---|---|
| Threat Name | PhantomCore |
| Threat Type | Backdoor Trojan / Remote Access Tool |
| Platform | Windows (all versions) |
| File Type | Windows PE executable (.exe) |
| First Observed | 2023 |
| Attribution | Head Mare hacktivist group |
| Primary Targets | Initially Russian infrastructure; now global distribution |
| Secondary Payloads | LockBit ransomware, Babuk ransomware, additional backdoors |
| Detection Names | Trojan:Win32/PhantomCore, Backdoor.PhantomCore, HEUR:Trojan.Win32.Generic |
| Severity Rating | Critical (enables ransomware deployment) |
| Persistence Method | Registry Run keys, scheduled tasks, service installation |
| Data at Risk | System information, IP addresses, network configuration, credentials, complete filesystem access |
How It Spreads
PhantomCore reaches victims through carefully crafted social engineering campaigns that exploit human trust rather than technical vulnerabilities. The Head Mare group has demonstrated patience and sophistication in their distribution methods, often spending weeks researching targets before launching attacks. Unlike automated malware campaigns, PhantomCore infections frequently involve customized lures designed for specific organizations or individuals. The most common infection vector involves phishing emails with malicious attachments disguised as invoices, shipping notifications, or urgent security updates. These emails often appear to come from legitimate services and include contextual details that make them convincing. Once the victim opens the attachment or clicks a malicious link, PhantomCore establishes its foothold silently in the background while displaying a decoy document to avoid suspicion. We've also observed PhantomCore distribution through: - **Compromised software downloads** — Trojanized versions of popular utilities hosted on third-party download sites - **Malicious advertisements** (malvertising) on legitimate websites that redirect to exploit kits - **Watering hole attacks** targeting specific industry forums and community sites - **Supply chain compromises** where legitimate software update mechanisms are hijacked - **Removable media** including USB drives left in public locations as bait - **Remote Desktop Protocol (RDP) brute-force attacks** against poorly secured systemsWhat It Does On Your Machine
Once PhantomCore executes, it immediately begins reconnaissance operations to profile your system. The malware collects your public IP address, operating system version, installed software, antivirus products, network configuration, and active user accounts. This information is transmitted to the attackers' command-and-control servers, where operators analyze whether your system is a valuable target worth exploiting further or should receive an immediate ransomware deployment. The backdoor component of PhantomCore provides attackers with comprehensive remote access capabilities. They can execute arbitrary commands, upload and download files, capture screenshots, log keystrokes, and monitor your activities in real-time. This level of access allows the Head Mare group to steal credentials, exfiltrate sensitive documents, and map your network infrastructure before deciding on their next move. Many victims remain unaware of the infection during this reconnaissance phase, which can last days or weeks. The truly devastating aspect of PhantomCore is its role as a delivery platform for ransomware. After gathering intelligence, attackers deploy secondary payloads like LockBit or Babuk ransomware that encrypt your entire filesystem. By the time you see the ransom note demanding payment in cryptocurrency, PhantomCore has already disabled backups, deleted shadow copies, and spread laterally to other machines on your network. The combination of data theft and encryption creates a double-extortion scenario where attackers threaten to publish stolen information even if you manage to recover your files.Manual Removal — Step by Step
Disconnect from the Network Immediately
Unplug your ethernet cable or disable Wi-Fi before proceeding. PhantomCore communicates continuously with its command servers and can trigger ransomware deployment if it detects removal attempts. Do NOT skip this step—network isolation is critical to prevent data loss and lateral spread to other devices on your network.
Boot Into Safe Mode with Networking
Restart your computer and repeatedly press F8 (or Shift+F8 on newer systems) during boot. Select "Safe Mode with Networking" from the Advanced Boot Options menu. This prevents PhantomCore's persistence mechanisms from auto-starting and limits its ability to interfere with removal. If you cannot access Safe Mode, the infection may have modified boot configuration—professional intervention is required.
Check Running Processes for Suspicious Activity
Open Task Manager (Ctrl+Shift+Esc) and examine running processes carefully. Look for unfamiliar executables, especially those with generic names like "svchost.exe" running from user directories rather than C:\Windows\System32. PhantomCore often masquerades as legitimate Windows services. Right-click suspicious processes and select "Open File Location"—legitimate Windows files will always be in system directories.
Remove Startup Entries and Scheduled Tasks
Press Win+R, type "msconfig" and hit Enter. Under the Startup tab (or "Open Task Manager" button on Windows 10/11), disable any unfamiliar entries, particularly those pointing to AppData directories. Then open Task Scheduler (search "Task Scheduler" in Start menu) and examine the Task Scheduler Library for suspicious scheduled tasks. Delete tasks that reference unknown executables or run with SYSTEM privileges without clear purpose.
Manually Delete PhantomCore Files
Navigate to C:\Users\[YourUsername]\AppData\Roaming and C:\Users\[YourUsername]\AppData\Local\Temp. Look for recently created folders with generic names like "SystemCore," "WindowsUpdate," or "Services." Delete these entire folders. Also check C:\ProgramData for similarly suspicious directories. Note that AppData folders are hidden by default—you must enable "Show hidden files" in File Explorer's View options first.
Clean the Windows Registry
Press Win+R, type "regedit" and hit Enter to open Registry Editor. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Delete any values that reference the PhantomCore executable paths you identified earlier. Exercise extreme caution—deleting wrong registry entries can break Windows. If you're uncertain, write down the entry names and call us for guidance.
Scan with Multiple Security Tools
Download and run Malwarebytes (free version) and perform a full system scan. Follow up with Microsoft Defender Offline scan (built into Windows Security). Run both scans completely—PhantomCore may have installed additional persistence mechanisms that manual removal missed. Do NOT rely on a single antivirus product, as detection rates vary significantly for sophisticated backdoors.
Check for Ransomware Deployment
Before reconnecting to the network, verify that no ransomware payload was deployed. Look for recently encrypted files (unusual extensions like .locked, .encrypted, or random characters), ransom notes (typically .txt or .html files on your desktop), or inability to open documents. If you find evidence of encryption, STOP immediately and contact professionals—attempting to remove ransomware without proper backups can cause permanent data loss.
Change All Passwords from a Clean Device
Assume that every password stored on the infected machine has been compromised. Using a different, known-clean computer or smartphone, change passwords for email, banking, social media, and any accounts you accessed from the infected system. Enable two-factor authentication wherever possible. PhantomCore includes keylogging capabilities that may have captured credentials you typed during the infection period.
Monitor for Reinfection and Data Misuse
After completing removal and reconnecting to the network, watch for signs of reinfection over the next several days. Monitor your bank accounts and credit reports for fraudulent activity. PhantomCore infections often involve data exfiltration, so stolen information may surface weeks or months later. Consider placing a fraud alert with credit bureaus if sensitive financial documents were accessible on the infected machine.
Prevention
- Implement email filtering and attachment scanning. Configure your email client or service to block executable attachments and scan all files with up-to-date antivirus before allowing access. Most PhantomCore infections begin with a malicious email attachment that could have been blocked at the gateway level.
- Disable macros in Office documents by default. PhantomCore delivery often relies on malicious macros in Word or Excel files. Set Office applications to disable all macros without notification, or at minimum require explicit approval before macro execution. Legitimate business documents rarely require macros.
- Keep Windows and all software rigorously updated. Enable automatic updates for Windows, browsers, Adobe products, and Java. Attackers exploit known vulnerabilities in outdated software to gain initial access. Monthly patch cycles are insufficient—configure systems to install critical updates within 24-48 hours of release.
- Use application whitelisting on critical systems. Configure Windows AppLocker or similar tools to allow only approved applications to execute. This prevents PhantomCore from running even if downloaded, as it won't be on the approved list. While this requires more management overhead, it provides strong protection against unknown malware.
- Segment your network and limit lateral movement. Don't allow workstations to communicate directly with each other or access administrative shares without authentication. PhantomCore operators leverage network access to spread ransomware to multiple machines—network segmentation limits the blast radius of an infection.
- Maintain offline, tested backups of critical data. Keep at least one complete backup that is physically disconnected from your network and computer. PhantomCore specifically targets backup systems before deploying ransomware. Test restoration regularly—untested backups often fail when you need them most.
- Restrict user permissions to minimum necessary access. Operate with standard user accounts for daily work rather than administrator accounts. PhantomCore and its ransomware payloads have significantly reduced impact when running without administrative privileges, as they cannot modify system files or install services.
- Educate yourself and employees about social engineering tactics. Recognize that technical security alone is insufficient when attackers exploit human psychology. Develop healthy skepticism about unexpected emails, verify sender authenticity through separate communication channels, and establish organizational policies for handling sensitive requests.