Ukrainian hacktivist groups BO Team and Head Mare cooperate against Russian targets

Russian cybersecurity company Kaspersky published a report on May 6, 2026, establishing operational links between the Ukrainian hacktivist groups BO Team and Head Mare in attacks targeting Russian entities. Researchers identified several shared infrastructures and tools used by the two groups, in particular command-and-control systems operating from the same compromised host.

According to Kaspersky, a “likely attack scenario” would involve initial access obtained through Head Mare’s phishing tools, before the deployment of BO Team’s malware. Active since early 2024, BO Team has gradually shifted away from destructive attacks in favor of cyberespionage. In 2026, BO Team targeted 20 Russian organizations, mainly companies in the manufacturing, telecommunications, oil and gas sectors.

First observed in 2023, Head Mare develops its own malware, including PhantomDL and PhantomCore. The group has specialized in exploiting recently disclosed vulnerabilities to conduct phishing campaigns.