Loading malware…
PhantomCore is a Windows backdoor associated with the Head Mare threat group. It enables remote execution of arbitrary commands, giving attackers control over infected systems. In observed TrueConf infections, the payload was deployed as a DLL and established persistence through COM hijacking, registering the malicious library for automatic execution.
In a July 2026 campaign, Head Mare distributed PhantomCore through trojanized TrueConf Client installers hosted on compromised enterprise video-conferencing servers. The attackers chained two TrueConf Server vulnerabilities to obtain privileged code execution, deployed a web shell, and replaced legitimate client distribution packages with malicious versions. These packages retained the legitimate client's installation functionality while also installing PhantomCore and lacked valid vendor digital signatures. Conference participants received the infected software as a client download or update, allowing compromise to extend to employees of external organizations joining meetings on affected servers.
The campaign targeted Russian organizations in instrumentation, electronics, transportation, energy, IT, and software development. PhantomCore was used alongside other Head Mare tools, including the separate PhantomGraph backdoor.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
В свежей кампании Head Mare проэксплуатировали цепочку уязвимостей в сервере видеоконференций TrueConf и заменили оригинальные инсталляторы клиента TrueConf на зараженные версии, устанавливающие в систему вредоносное ПО PhantomCore.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
This web shell is later used to gather information about the IT infrastructure of the attacked organization, gain privileged access to the TrueConf Server database
When members of the organization connect to the local TrueConf server, they receive a trojanized, non-digitally signed client installer as an update.
An unauthorized attacker can connect to TrueConf server versions 5.3.X before 5.3.9, 5.4.X before 5.4.9, 5.5.X before 5.5.5 ... via port 4307/TCP ... and execute a malicious script on the server by calling an undocumented function.
The attackers also replaced the TrueConf client distribution file, trueconf_windows_client_x64.exe, with a malicious version causing users who joined a TrueConf meeting on a compromised server to receive a prompt to install the trojanized version.
[They] replace the legitimate TrueConf Client installer on the server with a malicious version containing the PhantomCore backdoor. When members of an organization connect to a compromised local TrueConf server, they can receive the trojanized installer as an update.
The attack was mapped to multiple MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application), T1566 (Phishing), T1199 (Trusted Relationship)
The attackers distribute their backdoors using various methods, including phishing, exploiting public web servers, or through a subcontractor.
Обнаружили еще одну масштабную фишинговую рассылку... Получателям приходят письма от имени научно-исследовательской организации... Во вложениях находятся зашифрованные архивы... В архиве — несколько файлов‑ярлыков (.lnk), которые автоматически запускают процесс загрузки и установки бэкдора.
all subsequent actions are carried out by remotely running PowerShell scripts via a web shell.
Промежуточный скрипт написан на PowerShell. Он скачивает с удаленного сервера файл USOCachedData.txt... обеспечивает закрепление в системе и автозапуск.
%TEMP%\cmd_cmd_*.bat
The malicious installer delivered PhantomCore malware, which Kaspersky said “enables the attacker to execute arbitrary commands, essentially providing them with full control over the infected system.”
Employees joining conferences hosted by suppliers or other third parties could potentially download a compromised client from someone else's hacked infrastructure.
the infected installer deploys the TrueConf client on the system, but also unpacks the PhantomCore malware to the path %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll
This web shell is later used to gather information about the IT infrastructure of the attacked organization, gain privileged access to the TrueConf Server database
To automatically launch the malware after system startup, a registry key is created: HKEY_CURRENT_USER\Software\Classes\CLSID{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32
This enables them to replace the file C:/Program Files/TrueConf Server/httpconf/site/public/js/locale.php with a malicious web shell program... Attackers use the web shell to install a backdoor-type malicious program on the server
/etc/systemd/system/omicluster.service /etc/systemd/system/schedul2-bin.service
Both components establish persistence on the server by creating services with the names SysExcSvc and SysReadSvc.
Head Mare leveraged this access to replace a TrueConf file, locale.php, with a web shell and install a backdoor, enabling further command execution
HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32
A registry key was created to ensure the malware automatically launched at every system startup.
The second vulnerability let attackers break out of an isolated execution environment and run code with NT AUTHORITY\SYSTEM privileges, granting full control of the server.
This web shell is later used to gather information about the IT infrastructure of the attacked organization, gain privileged access to the TrueConf Server database
/etc/systemd/system/omicluster.service /etc/systemd/system/schedul2-bin.service
Both components establish persistence on the server by creating services with the names SysExcSvc and SysReadSvc.
Head Mare leveraged this access to replace a TrueConf file, locale.php, with a web shell and install a backdoor, enabling further command execution
HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32
A registry key was created to ensure the malware automatically launched at every system startup.
They exploited KLCERT-26-057 to execute a malicious script in the isolated TrueConf environment, then KLCERT-26-058 to escape the sandbox and execute commands on the underlying operating system.
as well as delete records from the TrueConf event logs related to the exploit’s operation.
This web shell is later used to gather information about the IT infrastructure of the attacked organization, gain privileged access to the TrueConf Server database
On Linux systems, attackers deployed a separate backdoor that hides its files
the infected installer deploys the TrueConf client on the system, but also unpacks the PhantomCore malware to the path %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll
To automatically launch the malware after system startup, a registry key is created: HKEY_CURRENT_USER\Software\Classes\CLSID{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32
Attackers then replaced legitimate TrueConf Client installers with trojanized versions containing the PhantomCore and PhantomGraph backdoors, turning the compromise into a supply-chain attack.
They then replaced the legitimate TrueConf Client installer hosted on the server with a trojanized, non-digitally signed version.
PhantomCore enabled reconnaissance, credential theft including LSASS dumping, and C2
Credential access was a key objective, with attackers dumping the memory of the LSASS process to exfiltrate credentials.
On Linux systems, attackers deployed a separate backdoor that hides its files, intercepts TrueConf network traffic, and uses GitHub for command-and-control.
On Linux systems, attackers deployed a separate backdoor that hides its files, intercepts TrueConf network traffic, and uses GitHub for command-and-control.
This web shell is later used to gather information about the IT infrastructure of the attacked organization
The attackers connect to the TrueConf server without prior authorization via port 4307/TCP... Once connected, attackers call a server function to transmit a malicious script and execute it on the server.
The attackers used the compromised server to collect infrastructure data, access the TrueConf database...
Exfiltration and C2 communications were conducted over both custom malicious domains and IP addresses, as well as via OneDrive cloud storage.
The attackers use a Microsoft OneDrive cloud storage account as the command and control (C&C) server... on *nix systems, the attackers install a backdoor that uses GitHub as a command and control channel.
The malicious installer delivered PhantomCore malware
В запросе на регистрацию PhantomCore передает закодированные в base64 данные о боте и зараженной системе.
Exfiltration and C2 communications were conducted over both custom malicious domains and IP addresses, as well as via OneDrive cloud storage.
90 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.