Security vendors say the threat actor known as Head Mare has once again weaponized weaknesses in unpatched TrueConf servers. The campaign targets Russian organizations across sectors such as instrumentation, electronics, transport, energy, IT, and software development, with activity reported by Kaspersky in July 2026.
This case stands out because the attackers don’t only gain access—they manipulate the server-side process so that legitimate client software can be distributed in a poisoned form. Below is what the reported TrueConf exploits chain enables, how it works step by step, and what updates reduce the risk.
What the reported TrueConf exploits are doing
According to Kaspersky, the attackers exploit a vulnerability chain in the TrueConf videoconferencing server. The goal is to replace the original TrueConf client installers with modified versions that deliver the PhantomCore backdoor and a remote access trojan (RAT) into vulnerable systems.
The research ties the activity to vulnerabilities tracked as KLCERT-26-057 and KLCERT-26-058. Together, they provide arbitrary code execution with elevated privileges, allowing the attackers to move from initial server-side manipulation to persistent compromise.
Affected TrueConf Server versions
The impacted builds span multiple branches, including:
- 5.3.x up to 5.3.9
- 5.4.x up to 5.4.9
- 5.5.x up to 5.5.5
- Earlier versions as well
While the findings describe exploitation of these older versions, the vendor has since released patches. Kaspersky notes fixes included in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5 released on June 18, 2026.
The exploitation chain, step by step
The reported workflow is structured around a default-exposed service and a two-stage exploit path. Kaspersky describes the sequence as follows:
- Connect to the TrueConf server over TCP port 4307, which is open by default.
- Exploit KLCERT-26-057 after connection to execute a malicious script on the server.
- Run inside an isolated environment on the server, limiting access to operating system functions at first.
- Exploit KLCERT-26-058 to break out of that isolated environment.
- Execute arbitrary code with SYSTEM privileges, specifically NT AUTHORITY\SYSTEM.
- Replace a server file used for web access—Kaspersky highlights replacing “…\public\js\locale.php” with a web shell to enable ongoing remote access.
This is where the attackers shift from “one-time compromise” to “persistent control.” From there, Kaspersky reports the web shell was used to collect information about the IT environment, obtain privileged access to the TrueConf database, and ultimately replace the legitimate client distribution with an infected one containing PhantomCore.
PhantomCore and the role of PhantomGraph
Beyond PhantomCore, the web shell also acted as a delivery conduit for another backdoor named PhantomGraph. The reporting indicates PhantomGraph shares some code overlap with PhantomCore and includes two DLL modules:
- SysExcSvc.dll: used to receive commands and exfiltrate results back to Microsoft OneDrive cloud storage, which is leveraged as command-and-control (C2).
- SysReadSvc.dll: used to parse the received commands, execute them, and store the results for the first module to send.
To keep access persistent, the attackers run a Base64-encoded PowerShell command that installs both DLL modules as Windows services. Kaspersky believes the malware was split into two components intentionally to reduce detectability by endpoint detection and response (EDR) tools.
Additional attacker actions: tunnels and credential access attempts
The intrusion wasn’t limited to the web shell and installer poisoning. Kaspersky also observed attacker behavior that included:
- Launching an SSH reverse tunnel
- Taking a memory dump of “lsass.exe”
- Collecting basic host information using commands such as hostname and whoami
Taken together, these actions suggest the attackers were preparing for deeper access and possible credential harvesting, while maintaining a communication channel back to infrastructure under their control.
Why this matters: the installer replacement threat
Many intrusion chains stop after gaining shell access. In this case, the TrueConf exploits chain was used to tamper with the distribution path—turning the compromised server into a source of malicious client installers. If customers or internal users download installers from the infected server, they may unknowingly introduce backdoors like PhantomCore into additional systems.
That combination—remote code execution plus poisoned software delivery—raises operational risk. It also increases the chance that compromise spreads beyond the originally attacked server, depending on how deployments and updates are handled in a given environment.
Related activity: earlier TrueConf abuses
Kaspersky’s reporting places this campaign in a broader pattern. It notes that this isn’t the first time Head Mare targeted TrueConf with zero-day style techniques against Russian entities.
For example, Positive Technologies disclosed earlier in April that multiple vulnerabilities in TrueConf were abused since September 2025 to deliver PHP web shells and malicious payloads for information theft and command execution. Separately, Check Point reported exploitation of another high-severity TrueConf client issue (CVE-2026-3502) in the wild, including campaigns that deployed a C2 framework called Havoc against government targets in Southeast Asia.
Patching guidance and immediate protective steps
Because the vulnerabilities were fixed in later TrueConf Server releases, the most direct mitigation is upgrading. Kaspersky advises organizations using TrueConf to download the latest patched versions for optimal protection.
In practical terms, that means ensuring your environment is on the patched builds mentioned in the reporting and verifying that any previously exposed or compromised servers are reviewed. If you suspect exposure, incident response typically includes checking for persistence mechanisms (like web shells and installed services), reviewing logs around the affected TCP port, and validating the integrity of any client installers served by TrueConf.
Broader pressure on Russian software update mechanisms
Kaspersky also connected this type of activity to wider targeting of commonly used software and update pathways. The report describes another APT-style intrusion involving the ViPNet update mechanism, where a loader DLL masquerades as a legitimate component used during updates. That attack involved components such as HelloInjector and HelloProxy, and it included behaviors like command execution, SSH tunneling, log clearing, and additional implants.
While this article focuses on the TrueConf compromise, the takeaway is consistent: widely deployed systems and their update or distribution processes can become high-value vectors for attackers.
Conclusion
The reported campaign shows how TrueConf exploits can be used not just to reach a server, but to turn that server into a delivery mechanism for compromised client installers. By chaining KLCERT-26-057 and KLCERT-26-058, attackers reportedly gain SYSTEM-level code execution, deploy a web shell for persistence, and use the access to replace official distributions with PhantomCore-enabled malware.
If you run TrueConf Server, upgrading to the patched versions highlighted by Kaspersky is essential. Just as important is validating whether any installer distribution points were affected and checking for persistence artifacts left behind by the attacker’s tooling.
Source: https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html
