Loading story…
The Head Mare threat group has been exploiting unpatched TrueConf Server vulnerabilities to compromise conferencing servers and replace legitimate TrueConf client installers with trojanized packages that deploy the PhantomCore backdoor. According to reporting citing Kaspersky, the attackers chained two flaws tracked as KLCERT-26-057 and KLCERT-26-058 to gain unauthenticated access over TCP port 4307, break out of TrueConf’s isolated environment, escalate privileges to NT AUTHORITY\SYSTEM, and install a persistent web shell on the server.
The intrusion set also includes the PhantomGraph backdoor, which uses Microsoft OneDrive for command-and-control and has been observed conducting reconnaissance, dumping LSASS memory, and creating reverse SSH tunnels. Multiple active campaigns have reportedly targeted Russian organizations in instrumentation, electronics, transportation, energy, IT, and software development, while patched TrueConf Server releases addressing the issue were made available in versions 5.3.9, 5.4.9, and 5.5.5.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Kaspersky said it now assesses Head Mare as an APT group rather than hacktivists, citing the group's sophisticated tradecraft and the absence of destructive activity such as encryption or wiping. The reassessment accompanied Kaspersky's reporting on active campaigns targeting Russian organizations.
Kaspersky researchers discovered in July that Head Mare was exploiting unpatched TrueConf Server instances to gain unauthenticated access, escalate to NT AUTHORITY\SYSTEM, install a web shell, and replace legitimate client installers with trojanized PhantomCore versions. The activity was part of multiple active campaigns targeting Russian organizations.
TrueConf fixed the vulnerabilities later tracked by Kaspersky as KLCERT-26-057 and KLCERT-26-058 in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5. The fixes covered affected 5.3.x, 5.4.x, 5.5.x, and older versions.
A threat research report revealed that Head Mare's trojanized TrueConf client installers delivered both PhantomCore and a second backdoor, PhantomGraph, which used Microsoft OneDrive for command-and-control and persisted as a Windows service. The report also published indicators of compromise including domains, IP addresses, MD5 hashes, and a registry path tied to the activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
16 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcemalware.news
Open sourcesecurelist.com
Open sourcescworld.com
Open sourcerescana.com
Open sourceopentip.kaspersky.com
Open sourceopentip.kaspersky.com
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added two **TrueConf Server** vulnerabilities to its Known Exploited Vulnerabilities catalog after reports that attackers were actively abusing them to gain remote code execution on exposed servers. The flaws, tracked as `CVE-2026-72529` and `CVE-2026-72530`, affect TrueConf Server **5.3.x before 5.3.9**, **5.4.x before 5.4.9**, and **5.5.x before 5.5.5**. According to the advisories, `CVE-2026-72529` is a missing-authentication flaw that can let an unauthenticated remote attacker execute arbitrary scripts over **4307/TCP**, while `CVE-2026-72530` is a code-injection issue that can allow breakout from an isolated environment and arbitrary code execution on the host system. Kaspersky reported that attackers linked to the **Head Mare** APT group chained the vulnerabilities to compromise TrueConf servers at Russian organizations, obtain **NT AUTHORITY\\SYSTEM**-level access on Windows hosts, and install web shells and backdoors. The intruders then mapped victim infrastructure, accessed databases, and replaced legitimate TrueConf client downloads with installers bundled with **PhantomCore** malware, turning meeting joins into an infection path for downstream users. TrueConf issued fixes on June 18 in versions **5.3.9**, **5.4.9**, and **5.5.5**, and government advisories in the United States and Canada urged administrators to review vendor guidance and apply updates immediately because even organizations that do not run TrueConf servers could be exposed through meetings hosted on compromised third-party systems.
Aug 22, 2026
A zero-day flaw in the TrueConf Windows client, tracked as **`CVE-2026-3502`** and rated **CVSS 7.8**, was exploited in the wild to compromise government entities in Southeast Asia. Researchers said the vulnerability stemmed from missing integrity and authenticity checks in TrueConf’s update validation process, allowing anyone who controlled an on-premises TrueConf server to replace legitimate client updates with arbitrary executables delivered through the trusted update channel. In the campaign dubbed **TrueChaos**, attackers used a weaponized TrueConf update to install malware while still performing a legitimate software upgrade, then dropped files including **`poweriso.exe`** and a malicious **`7z-x64.dll`** for DLL sideloading. The intrusion reportedly involved persistence, privilege escalation, reconnaissance, hands-on-keyboard activity, and retrieval of additional payloads, with researchers assessing that the operation likely aimed to deploy the **Havoc** command-and-control framework and was linked with moderate confidence to a Chinese-nexus threat actor. TrueConf released a fix in Windows client version **8.5.3**.
Jun 29, 2026
Multiple vulnerabilities in **TrueConf Server** were disclosed as affecting Windows deployments, including a **high-severity authentication bypass** tracked as `BDU:2025-10114`. The flaw stems from an alternative path or channel weakness (`CWE-228`) that allows remote attackers to send certain API requests without proper authentication, including access to some `/admin/*` endpoints where authorization checks are not correctly enforced. Russian vulnerability records state the issue affects multiple versions before vendor-fixed releases, that **exploit code exists**, and that the vulnerability has been **observed in attacks**. A related TrueConf Server issue, `BDU:2025-10115`, allows attackers to **read arbitrary files** on affected systems, expanding the risk from unauthorized administrative access to potential exposure of sensitive local data. Positive Technologies flagged both `BDU:2025-10114` and `BDU:2025-10115` as **trending vulnerabilities**, while a third identifier, `BDU:2025-10116`, was also listed without public technical details. The vendor has confirmed the disclosed issues and recommends applying the latest software updates and following official remediation guidance.
Jun 29, 2026