MalwareUsed by 1 actor

PhantomGraph

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Head Mare

Additionally, Head Mare deploys PhantomGraph, a separate backdoor consisting of two DLL files (SysExcSvc.dll and SysReadSvc.dll) that accept commands via a Microsoft OneDrive account, execute them, and return the results.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers... Kaspersky says it is currently observing multiple active Head Mare campaigns... using several initial access methods that include phishing, exploiting public-facing web servers, and access via contractors.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

KLCERT-26-058 to escape the sandbox and run commands on the underlying operating system... The malware also runs commands for reconnaissance activity, such as hostname and whoami.

Privilege Escalation

1 technique

T1068Exploitation for Privilege EscalationEvidence1

They leveraged a vulnerability internally tracked by Kaspersky as KLCERT-26-057 to execute a malicious script within TrueConf's isolated environment, and KLCERT-26-058 to escape the sandbox and run commands on the underlying operating system. The attacker then increased their privileges to NT AUTHORITY\SYSTEM.

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

Observed attacker activity through PhantomGraph included dumping the memory of the Local Security Authority Subsystem Service (LSASS) process to exfiltrate credentials.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

The malware also runs commands for reconnaissance activity, such as hostname and whoami.

T1082System Information DiscoveryEvidence1

The malware also runs commands for reconnaissance activity, such as hostname and whoami.

Lateral Movement

1 technique

T1021.004SSHEvidence1

The malware also runs commands for reconnaissance activity, such as hostname and whoami, and starts a reverse SSH tunnel.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

PhantomGraph, a separate backdoor consisting of two DLL files (SysExcSvc.dll and SysReadSvc.dll) that accept commands via a Microsoft OneDrive account, execute them, and return the results.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

bleeping computerNews

Aug 8, 2026

Hackers breach TrueConf to trojanize client installers with backdoors

A DLL-based backdoor that receives commands through a Microsoft OneDrive account, executes them, returns results, performs reconnaissance, dumps LSASS memory for credential theft, and starts a reverse SSH tunnel.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

PhantomGraph

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Head Mare

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

KLCERT-26-058 to escape the sandbox and run commands on the underlying operating system... The malware also runs commands for reconnaissance activity, such as hostname and whoami.

Privilege Escalation

1 technique

T1068Exploitation for Privilege EscalationEvidence1

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

Observed attacker activity through PhantomGraph included dumping the memory of the Local Security Authority Subsystem Service (LSASS) process to exfiltrate credentials.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

The malware also runs commands for reconnaissance activity, such as hostname and whoami.

T1082System Information DiscoveryEvidence1

The malware also runs commands for reconnaissance activity, such as hostname and whoami.

Lateral Movement

1 technique

T1021.004SSHEvidence1

The malware also runs commands for reconnaissance activity, such as hostname and whoami, and starts a reverse SSH tunnel.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

PhantomGraph, a separate backdoor consisting of two DLL files (SysExcSvc.dll and SysReadSvc.dll) that accept commands via a Microsoft OneDrive account, execute them, and return the results.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

bleeping computerNews

Aug 8, 2026

Hackers breach TrueConf to trojanize client installers with backdoors

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.