Threat Profile
| Threat Name | PhantomGraph |
|---|---|
| Threat Type | Backdoor / Remote Access Trojan (RAT) |
| Target Platform | Windows (native 64-bit DLL modules) |
| File Type | Windows PE executable (DLL) |
| Attributed Actor | Head Mare APT group |
| First Documented | 2026 (updated intelligence through August 2026) |
| Persistence Method | Registered as Windows services via encoded PowerShell |
| Detection Complexity | High (split-module architecture designed to evade EDR) |
| Primary Payload | Remote command execution with output exfiltration |
| Communication Protocol | Abuses legitimate services (method not fully disclosed) |
| Typical Targets | Organizations with high-value intellectual property or sensitive data |
| Removal Difficulty | High (requires service enumeration, registry cleanup, and thorough forensic validation) |
How It Spreads
PhantomGraph is not distributed through mass spam campaigns or drive-by downloads. As an APT tool, it arrives through highly targeted intrusion chains orchestrated by skilled human operators. The Head Mare group typically gains initial access through spear-phishing emails containing malicious attachments or links, credential harvesting from previous breaches, or exploitation of unpatched vulnerabilities in perimeter systems like VPNs and web applications. Once the attackers establish an initial foothold, they perform reconnaissance, elevate privileges, and move laterally across the network before deploying PhantomGraph on high-value systems. The malware is installed manually by the threat actors—not through automated worm behavior—meaning its presence indicates you are being actively targeted by a sophisticated adversary. Common delivery mechanisms observed with APT campaigns include: - Spear-phishing emails with weaponized Office documents or PDF attachments - Exploitation of known or zero-day vulnerabilities in internet-facing services - Compromised credentials obtained through previous breaches or password-spraying attacks - Supply-chain compromise of legitimate software updates - Lateral movement from previously compromised systems within the same networkWhat It Does On Your Machine
PhantomGraph's architecture is deliberately fragmented to complicate detection. Upon deployment, the attackers use an encoded PowerShell command to register two separate 64-bit DLL files as Windows services. This ensures the malware starts automatically each time Windows boots, maintaining persistent access even after system restarts. The PowerShell command itself is often obfuscated using Base64 encoding or similar techniques to avoid triggering signature-based antivirus alerts. The first module handles all network communications with the attackers' command-and-control (C2) infrastructure. It reaches out to receive tasking instructions—commands the operators want to execute—and later retrieves the results of those commands for exfiltration. Significantly, Kaspersky's research indicates this module abuses legitimate services for C2 communications, making network-level detection extremely challenging since the traffic blends in with normal business activity. The module operates silently in the background as a Windows service, requiring no visible windows or user interaction. The second module is the execution engine. It reads queued commands from the first module, writes them to a batch file on disk, invokes that batch file through the Windows command interpreter (cmd.exe), captures the output, and writes the results to a file for the communication module to retrieve. This indirect execution method—using temporary batch files rather than direct API calls—further obscures the malware's behavior from security tools monitoring process creation or API usage.Manual Removal — Step by Step
Disconnect from the network immediately
Unplug the Ethernet cable or disable Wi-Fi before proceeding. PhantomGraph is designed to communicate with remote operators who may react to your removal attempts by executing destructive commands or exfiltrating data more aggressively. Network isolation is critical.
Boot into Safe Mode with Networking
Restart the computer and press F8 (or Shift+F8 on newer systems) during boot to access Advanced Boot Options. Select "Safe Mode with Networking." This prevents most services—including PhantomGraph's service-based components—from starting automatically, giving you a cleaner environment for removal.
Identify suspicious services using Services.msc
Press Windows+R, type services.msc, and press Enter. Sort by the "Startup Type" column and look for services set to "Automatic" that have random or generic names you don't recognize. PhantomGraph registers itself as a service, often with a name designed to blend in with legitimate Windows components. Note the service names and their executable paths.
Stop and disable the malicious services
For each suspicious service, right-click it and select "Properties." Click "Stop" to halt the service immediately, then change the "Startup type" dropdown to "Disabled." Click "Apply" and "OK." This prevents the service from restarting even if you reboot before completing removal.
Delete the malicious DLL files
Navigate to the file paths you noted in the Services properties (typically in C:\Windows\System32). Delete the DLL files associated with the suspicious services. You may need to take ownership of these files first: right-click the file, select Properties > Security > Advanced > Owner > Change, enter your username, check "Replace owner on subcontainers and objects," and click OK.
Remove the service registry entries
Press Windows+R, type regedit, and press Enter. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Locate the registry keys corresponding to the malicious service names you identified. Right-click each key and select "Delete." Be extremely careful here—deleting the wrong service can prevent Windows from booting.
Search for and delete temporary batch files
PhantomGraph drops temporary batch files to execute commands. Open File Explorer and navigate to C:\Users\[YourUsername]\AppData\Local\Temp. Sort by "Date Modified" and delete any recently created .bat files with random names. Also check C:\Windows\Temp for similar files.
Check PowerShell execution policy and logs
Open PowerShell as Administrator and run Get-ExecutionPolicy. If it returns "Unrestricted" or "Bypass," the attackers may have changed it to facilitate their encoded PowerShell installation command. Run Set-ExecutionPolicy RemoteSigned to restore a safer default. Review PowerShell history at %USERPROFILE%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt for evidence of malicious encoded commands.
Run a full system scan with updated security software
Reconnect to the network (still in Safe Mode if possible) and update your antivirus or EDR software to the latest definitions. Run a complete system scan to catch any additional components, persistence mechanisms, or related malware the attackers may have deployed alongside PhantomGraph.
Change all passwords and review account activity
PhantomGraph provides attackers with command-line access, meaning they could have harvested credentials, browser cookies, or authentication tokens. Change passwords for all accounts accessed from this machine, enable multi-factor authentication where available, and review login logs for unauthorized access. Consider this a full compromise—assume everything on the machine was accessible to the attackers.
Prevention
- Implement application whitelisting and strict service controls. Use Windows AppLocker or similar tools to restrict which DLLs and executables can be loaded as services. PhantomGraph's installation depends on registering arbitrary DLLs as services—a capability that should be tightly controlled on production systems.
- Monitor PowerShell activity with script block logging. Enable PowerShell script block logging via Group Policy (
Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging). This records all PowerShell commands, including encoded ones, to the event log where your security tools can analyze them for suspicious patterns. - Deploy endpoint detection and response (EDR) with behavioral analysis. Signature-based antivirus won't catch PhantomGraph reliably because each module performs seemingly benign actions. Modern EDR platforms that analyze process chains, file-write patterns, and service creation events are essential for detecting this type of multi-stage threat.
- Segment your network and enforce least-privilege access. APT groups like Head Mare rely on lateral movement after the initial compromise. Network segmentation limits how far attackers can spread, while strict access controls reduce the number of systems where they can deploy tools like PhantomGraph.
- Patch internet-facing systems aggressively and reduce attack surface. Keep VPNs, web servers, email gateways, and other perimeter systems fully patched. Disable unnecessary services and close unused ports. The fewer vulnerabilities you expose, the harder it is for attackers to gain that critical initial foothold.
- Conduct regular threat-hunting exercises. Don't wait for alerts. Proactively search for indicators of compromise like unusual service names, unexpected DLLs in System32, recent PowerShell history, or anomalous batch file executions in Temp directories. APT-level threats often persist for months before detection—active hunting shortens that window.
- Train users to recognize and report spear-phishing attempts. Even the best technical controls can be bypassed by a well-crafted phishing email. Regular security awareness training, combined with simulated phishing exercises, helps users identify suspicious messages and report them before clicking.
- Maintain offline backups with immutable storage. If PhantomGraph is discovered on your network, assume the attackers may have accessed or exfiltrated sensitive data. Having clean, offline backups ensures you can recover systems without paying ransoms or relying on potentially compromised images.