The hacktivist group Head Mare has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace legitimate client installers with trojanized versions carrying backdoors, according to Kaspersky researchers.
TrueConf is widely deployed in Russia’s enterprise and government sectors as an on-premise alternative to Western conferencing tools such as Zoom and Microsoft Teams. Kaspersky discovered the attacks in July after tracking Head Mare’s exploitation of two flaws it internally tracks as KLCERT-26-057 and KLCERT-26-058.
How the attack works
The attackers connect to TrueConf servers over TCP port 4307, which is open by default, without needing authentication. KLCERT-26-057 lets them execute a malicious script inside TrueConf’s isolated environment, while KLCERT-26-058 allows them to escape that sandbox and run commands directly on the underlying operating system.
Once inside, Head Mare escalates privileges to NT AUTHORITY\SYSTEM and replaces the file locale.php with a web shell, granting persistent remote access. From there, the attackers harvest sensitive data, access the TrueConf database, and swap the server’s hosted client installer with a malicious, unsigned version containing the PhantomCore backdoor. Any employee, including those at partner organizations who connect to a compromised counterparty’s TrueConf server for meetings, can unknowingly download the infected installer as a supposed update.
Kaspersky also observed deployment of PhantomGraph, a second backdoor built from two DLLs (SysExcSvc.dll and SysReadSvc.dll) that receive commands through a Microsoft OneDrive account and return results. Activity tied to PhantomGraph includes dumping LSASS process memory to steal credentials, running reconnaissance commands like hostname and whoami, and opening reverse SSH tunnels.
Broader campaign and patch status
Kaspersky says Head Mare currently runs multiple active campaigns against Russian organizations in instrumentation, electronics, transportation, energy, IT, and software development, using phishing, exploitation of public-facing web servers, and access through contractors as initial entry points.
The exploited flaws affect TrueConf Server versions 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and older releases. The vendor patched them in versions 5.3.9, 5.4.9, and 5.5.5, released on June 18. This follows an earlier incident reported by Check Point Research in April 2026, in which a zero-day arbitrary file execution flaw, CVE-2026-3502, was exploited in a campaign dubbed Operation True Chaos, tentatively linked to Chinese threat actors deploying the Havoc implant.
Organizations running TrueConf Server should update immediately, verify installer integrity through official channels, and review logs for unauthorized access via port 4307 or unexpected modifications to server-hosted files.