Loading story…
A zero-day flaw in the TrueConf Windows client, tracked as CVE-2026-3502 and rated CVSS 7.8, was exploited in the wild to compromise government entities in Southeast Asia. Researchers said the vulnerability stemmed from missing integrity and authenticity checks in TrueConf’s update validation process, allowing anyone who controlled an on-premises TrueConf server to replace legitimate client updates with arbitrary executables delivered through the trusted update channel.
In the campaign dubbed TrueChaos, attackers used a weaponized TrueConf update to install malware while still performing a legitimate software upgrade, then dropped files including poweriso.exe and a malicious 7z-x64.dll for DLL sideloading. The intrusion reportedly involved persistence, privilege escalation, reconnaissance, hands-on-keyboard activity, and retrieval of additional payloads, with researchers assessing that the operation likely aimed to deploy the Havoc command-and-control framework and was linked with moderate confidence to a Chinese-nexus threat actor. TrueConf released a fix in Windows client version 8.5.3.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-3502, a TrueConf Client vulnerability involving download of code without an integrity check, to its Known Exploited Vulnerabilities Catalog after determining there was evidence of active exploitation. The agency said federal civilian agencies must remediate the flaw under Binding Operational Directive 22-01 and urged all organizations to prioritize patching.
Check Point Research disclosed the zero-day vulnerability CVE-2026-3502, detailed its exploitation in the TrueChaos campaign, and assessed with moderate confidence that the activity is linked to a Chinese-nexus threat actor. The disclosure also described the attack chain involving a malicious TrueConf update, DLL sideloading, and follow-on hands-on-keyboard activity.
After responsible disclosure, TrueConf developed a fix for the update validation vulnerability tracked as CVE-2026-3502. The patch was included in TrueConf Windows client version 8.5.3 released in March 2026.
Check Point observed in-the-wild exploitation of the TrueConf Windows client flaw beginning in early 2026, targeting government entities in Southeast Asia. Attackers abused control of on-premises TrueConf servers to distribute weaponized updates, leading to malware deployment, persistence, and likely Havoc implant delivery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourcecisa.gov
Open sourcehelpnetsecurity.com
Open sourcegithub.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in **TrueConf Server** were disclosed as affecting Windows deployments, including a **high-severity authentication bypass** tracked as `BDU:2025-10114`. The flaw stems from an alternative path or channel weakness (`CWE-228`) that allows remote attackers to send certain API requests without proper authentication, including access to some `/admin/*` endpoints where authorization checks are not correctly enforced. Russian vulnerability records state the issue affects multiple versions before vendor-fixed releases, that **exploit code exists**, and that the vulnerability has been **observed in attacks**. A related TrueConf Server issue, `BDU:2025-10115`, allows attackers to **read arbitrary files** on affected systems, expanding the risk from unauthorized administrative access to potential exposure of sensitive local data. Positive Technologies flagged both `BDU:2025-10114` and `BDU:2025-10115` as **trending vulnerabilities**, while a third identifier, `BDU:2025-10116`, was also listed without public technical details. The vendor has confirmed the disclosed issues and recommends applying the latest software updates and following official remediation guidance.
Jun 29, 2026
A suspected China-linked espionage actor has been actively exploiting **CVE-2025-22457**, a critical stack-based/buffer overflow flaw in **Ivanti Connect Secure** that enables unauthenticated remote code execution and full device compromise. Ivanti and Mandiant said exploitation began in mid-March against vulnerable **Ivanti Connect Secure** appliances, with attacks also affecting **Pulse Connect Secure** and prompting security updates for **Ivanti Policy Secure** and **ZTA Gateways**. The flaw carries a **CVSS 9.0** rating and affects Ivanti Connect Secure `22.7R2.5` and earlier, while the corrected version was shipped in `22.7R2.6`. Mandiant attributed the activity and deployment of the **SPAWN** malware ecosystem to **UNC5221**, a suspected China-nexus threat actor known for targeting edge devices with zero-days. Post-compromise activity included a shell-script dropper that installs two newly identified malware families, **TRAILBLAZE** and **BRUSHFIRE**, while operators also attempted to evade detection by tampering with Ivanti's Integrity Checker Tool and routing activity through compromised **Cyberoam**, **QNAP**, and **ASUS** devices. Ivanti and defenders urged organizations to immediately upgrade supported systems, migrate away from end-of-support **Pulse Connect Secure**, and monitor for indicators such as web-process core dumps, Integrity Checker Tool state dumps, and anomalous client TLS certificates.
Jul 24, 2026
Microsoft released security updates addressing **79 vulnerabilities** across its product portfolio, including **19 remote code execution** flaws and several issues already under active exploitation. The most severe bug, **`CVE-2024-43491`**, is a **Windows Update** use-after-free vulnerability with a **CVSS 9.8** rating that can allow **unauthenticated remote code execution**. Critical vulnerabilities were also reported in **Microsoft SharePoint Server**, **Azure Web Apps**, **Azure Stack Hub**, and **Windows Network Address Translation**, expanding the risk beyond endpoint systems to server and cloud-connected environments. Microsoft and third-party reporting said attackers were already exploiting **`CVE-2024-38014`** in **Windows Installer**, **`CVE-2024-38217`** in **Mark of the Web**, **`CVE-2024-38226`** in **Microsoft Publisher**, and **`CVE-2024-43491`** in **Windows Update**. The updates were published through Microsoft’s Security Update Guide and release notes, including related Mariner release information, and organizations were urged to prioritize deployment because the exploited flaws span privilege escalation and remote code execution paths across multiple supported Windows versions and Microsoft products.
Jul 24, 2026