A recent security report describes a TrueConf breach installers incident in which hackers replaced legitimate video conferencing client packages with malicious versions. The goal was not simply disruption, but long-term access through backdoors delivered during the update process.
According to findings shared by Kaspersky, the activity was tied to the Head Mare hacktivist group and focused on unpatched TrueConf servers. In multiple observed campaigns, attackers chained vulnerabilities, deployed web shells for persistence, and ultimately pushed trojanized client installers to victims.
How the attackers compromised TrueConf servers
Kaspersky identified two vulnerabilities that were used against specific TrueConf Server versions. The flaws impacted TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, and 5.5.x before 5.5.5, along with older releases. The vendor later released fixes in versions 5.3.9, 5.4.9, and 5.5.5 on June 18.
The attack path relied on a network configuration detail as well. Researchers found the threat actor used TCP port 4307, which is open by default, to connect to the target TrueConf server without authentication. From there, the attackers were able to execute code with very high privileges.
From sandbox to operating system control
Once connected, the attackers used vulnerabilities internally tracked by Kaspersky as KLCERT-26-057 and KLCERT-26-058. First, they executed a malicious script inside TrueConf’s isolated environment. Then they escaped that sandbox to run commands directly on the underlying operating system.
After gaining control, the attackers escalated privileges until they reached NT AUTHORITY\SYSTEM. That level of access made it possible to modify files on the server and support persistent remote access.
Persistent access via web shell and data access
With elevated privileges, the attackers replaced the \public\js\locale.php file with a web shell. This provided ongoing command and control capability on the compromised server.
Kaspersky also reports that the web shell was used to collect sensitive information from the victim environment, interact with the TrueConf database, and support changes to the client update content hosted on the server.
Trojanized TrueConf client installer updates
The most concerning part of the TrueConf breach installers campaign is how attackers weaponized the normal update flow. Instead of distributing a random malware download, the threat actor modified the legitimate TrueConf Client installer so it contained a backdoor.
Specifically, Kaspersky observed that the malicious installer version was non-digitally signed and served as an update when organization members connected to the local TrueConf server.
In other words, even if an organization does not run the TrueConf server itself, employees can still be affected. If they join meetings that rely on a compromised counterparty server, they may receive the infected installation package and run it.
PhantomCore backdoor and what it enabled
The trojanized installer delivered the PhantomCore backdoor. This component was designed to maintain malicious capability on compromised systems after the installation process completed.
The report places PhantomCore in the broader context of the attacker’s objective: turning the server compromise into a distribution channel for malware, then using that access to gather information and maintain control.
PhantomGraph: a separate backdoor with OneDrive command flow
Beyond PhantomCore, Head Mare also deployed PhantomGraph, described by Kaspersky as a separate backdoor. This one consisted of two DLL files: SysExcSvc.dll and SysReadSvc.dll.
PhantomGraph accepted commands through a Microsoft OneDrive account. After receiving instructions, it executed them and returned results, creating another channel for controlling compromised hosts.
Credential theft and reconnaissance activity
Observed activity connected to PhantomGraph included dumping the memory of the LSASS process (Local Security Authority Subsystem Service) in order to exfiltrate credentials. In addition, the malware performed reconnaissance tasks such as checking the hostname and running whoami.
The backdoor also established a reverse SSH tunnel, which can help attackers maintain access even when direct inbound connectivity is restricted.
Who was targeted and how initial access happened
Kaspersky stated it observed multiple active Head Mare campaigns targeting organizations in Russia across several sectors. Reported targets included instrumentation, electronics, transportation, energy, IT, and software development.
As for initial access methods, the threat actor used several approaches, including phishing, exploitation of public-facing web servers, and access via contractors. This variety suggests the group aimed to create multiple routes into environments, then follow through with exploitation of specific TrueConf weaknesses.
Why patching matters: versions and timeline
If you manage TrueConf Server instances, the update timeline is critical. Kaspersky’s findings align with the vendor fixes released in June, covering the vulnerable branches mentioned earlier.
Based on the reported affected ranges, systems running TrueConf Server versions below the patched releases remained at risk. Updating to the fixed versions—5.3.9, 5.4.9, and 5.5.5—was the corrective step identified by the disclosure.
Other related reporting: trojanized updates and zero-day notes
Later reporting from Check Point Research indicated additional targeting of TrueConf via a zero-day arbitrary file execution flaw identified as CVE-2026-3502. Check Point called the activity Operation True Chaos and tentatively associated it with Chinese threat actors behind the Havoc implant used in these intrusions.
While the details of that separate effort are not the same as Kaspersky’s described PhantomCore/PhantomGraph chain, the overall theme matches: attackers have been focused on compromising TrueConf infrastructure and distributing malicious client updates.
What security teams can do next
Incidents like this highlight that monitoring alone may not be enough. Many intrusions move through environments without triggering obvious alerts, particularly when attackers obtain high privileges and blend actions into normal application workflows.
Practically, defenders should treat TrueConf breach installers as a reminder to:
- Patch TrueConf Server promptly, especially if running versions within the vulnerable ranges described in the report.
- Review exposure of network services such as TCP port 4307 and confirm that intended access controls are in place.
- Hunt for signs of server-side modification, including unexpected changes to files involved in client update delivery.
- Validate client updates—especially those that arrive via server-provided installation packages—and investigate unsigned installer events.
- Look for post-installation behavior consistent with backdoors, such as credential access attempts and outbound tunneling patterns.
Conclusion
The reported TrueConf breach installers case shows how attackers can turn a conferencing platform into a malware distribution mechanism. By exploiting unpatched server vulnerabilities, gaining SYSTEM-level control, replacing update components, and deploying multiple backdoors, Head Mare created a scenario where victims may receive infected installers during ordinary meeting and update workflows.
For organizations using TrueConf—particularly in enterprise or government environments—fast patching and stronger controls around server exposure and update integrity are essential to reduce the risk of trojanized updates and follow-on compromise.
