No AI analysis yet.
According to Kaspersky, PhantomGraph is a Windows backdoor used by the Head Mare APT group, deployed as two native 64-bit DLL modules that are registered as Windows services via an encoded PowerShell command for persistence. The two components divide the work deliberately to complicate EDR detection: one module handles communication with the operators, retrieving tasking and returning results, while the second reads the queued command, executes it through a dropped batch file invoked by the command interpreter, and writes the output back to a file for pickup. For command and control it abuses a commercial cloud storage service through its API, authenticating with OAuth refresh tokens and file read/write scopes so that traffic blends into legitimate cloud usage. Observed post-exploitation tasking through the backdoor included host and user reconnaissance, dumping the memory of a credential-holding system process, and establishing reverse SSH tunnels; parts of its code overlap with PhantomCore, which is what ties the family to Head Mare. Attributed to: Head Mare.