Threat Actor
PhantomCore
- First Reported
- Sep 9, 2025
- Latest Reported
- Sep 9, 2025
Reported Context (1)
- APT group tracked since early 2024 and reported to conduct cyberespionage against Russian critical infrastructure. Researchers reported 181 compromised hosts in the analyzed activity and assessed that PhantomGoShell testers may represent a separate splinter organized by a core member; this relationship is an assessment, not a confirmed split. PhantomCore Campaign Compromises 181 Russian Hosts in Cyberespionage Operation
Malware (6)
People (1)
MITRE ATT&CK (37)
Vendors (5)
Products (11)
Tools (6)
Industries (8)
Countries (9)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.