Head Mare
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 2 incidents
- Sources
- 0 sources
- First seen
- 2024-05-01
- Last seen
- 2024-05-31
- Updated
- 2026-10-12 23:33
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Head Mare is a threat actor operating from Russia, known by that alias. The group has targeted Russian organizations in the retail and logistics sectors, employing ransomware that encrypts servers and destroys backups, as seen in the May 2024 attack on a major delivery service and the May 2024 disruption of a discount retail chain’s website, mobile app, payment processing and online order systems. In the retail incident the actors were suspected of extortion, with potential losses exceeding 500 million rubles, while in the delivery case they criticized the victim’s security and service quality. No public attribution to a state sponsor or criminal consortium has been made, and the reported tactics are limited to ransomware deployment without disclosed initial‑access vectors or specific malware families.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 0 sources.