Clarissa Hana
The cybersecurity landscape has been significantly impacted by a sophisticated campaign orchestrated by the hacktivist group Head Mare, which has been actively exploiting unpatched vulnerabilities within TrueConf video conferencing servers. This exploitation allows the attackers to replace legitimate client installers with malicious versions designed to deliver potent backdoors, posing a severe threat to organizations, particularly within Russia’s enterprise and government sectors. TrueConf, a platform often chosen for its on-premise deployment and perceived security advantages over Western alternatives like Zoom and Microsoft Teams, has become a critical vector for these attacks.
The modus operandi involves gaining unauthorized access to TrueConf servers by leveraging critical vulnerabilities that permit arbitrary code execution with the highest privileges. Once inside, the threat actors deploy advanced malware, specifically the PhantomCore and PhantomGraph backdoors. Researchers at Kaspersky, a leading cybersecurity firm, first identified this malicious activity in July, meticulously documenting the methods employed by Head Mare. Their analysis revealed a disturbing reliance on default configurations and known weaknesses within the TrueConf infrastructure.
The Attack Chain: Exploitation and Persistence
Kaspersky’s investigation pinpointed the use of TCP port 4307, which is often left open by default in TrueConf server installations, as an initial access point. This port allowed Head Mare to connect to target servers without requiring any form of authentication, a critical oversight that dramatically lowers the barrier to entry for attackers. Once a connection was established, the attackers exploited two specific vulnerabilities, internally cataloged by Kaspersky as KLCERT-26-057 and KLCERT-26-058.
The first vulnerability, KLCERT-26-057, enabled the execution of a malicious script within the highly restricted, isolated environment of the TrueConf application. This "sandbox" environment is designed to contain potential threats, but the subsequent exploitation of KLCERT-26-058 allowed the attackers to break free from these constraints. This sandbox escape granted them the ability to execute commands directly on the underlying operating system of the compromised server.
With a foothold on the server’s operating system, Head Mare proceeded to escalate their privileges to the highest level, achieving NT AUTHORITYSYSTEM status. This elevated access is akin to having administrator rights on a Windows system, granting them unfettered control. In a crucial step towards establishing long-term persistence, the attackers replaced a legitimate file, publicjslocale.php, with a malicious web shell. This web shell acts as a covert communication channel, providing the attackers with persistent remote access to the compromised TrueConf server, allowing them to operate undetected for extended periods.
Trojanizing Client Installers: The Distribution Mechanism
The ultimate objective of gaining server access is to compromise the end-users who rely on the TrueConf service. Kaspersky’s report details how Head Mare utilizes the compromised server to collect sensitive information from the victim’s environment and access the TrueConf database. More critically, they then replace the legitimate TrueConf Client installer, which is typically hosted on the server for internal updates, with a trojanized version.
This malicious installer is embedded with the PhantomCore backdoor. When employees within an organization connect to their internal TrueConf server to receive updates or download the client, they inadvertently download and install the compromised version. This update process, designed to be seamless and trusted, becomes the primary vector for malware propagation. The trojanized installers are notably not digitally signed, a significant red flag that users and security systems should ideally detect, though the reliance on automated update processes can bypass manual checks.
The implications of this distribution method are far-reaching. Kaspersky explicitly warns that even organizations that do not directly use TrueConf servers can still fall victim. Employees might connect to compromised servers belonging to business partners or counterparties to participate in online meetings. During these interactions, they could unknowingly download the infected installation packages, effectively spreading the malware beyond the initially targeted network. This highlights the interconnectedness of modern business communication and the potential for cascading security failures.
PhantomGraph: A Secondary Backdoor for Advanced Espionage
In addition to PhantomCore, Head Mare also deploys a separate, sophisticated backdoor known as PhantomGraph. This malware is comprised of two Dynamic Link Library (DLL) files, named SysExcSvc.dll and SysReadSvc.dll. PhantomGraph operates by accepting commands through a seemingly innocuous Microsoft OneDrive account. Upon receiving instructions, it executes them and then transmits the results back to the attacker, also via the OneDrive service.
The observed activities conducted using PhantomGraph are indicative of advanced espionage operations. This includes the dumping of memory from the Local Security Authority Subsystem Service (LSASS) process. The LSASS process is responsible for managing security policies and user authentication on Windows systems, and its memory often contains sensitive credential information, such as usernames and passwords. Exfiltrating this data provides attackers with the keys to further penetrate the compromised network and potentially access other critical systems.
Furthermore, PhantomGraph is employed for reconnaissance. The attackers use it to execute common commands like hostname and whoami to gather basic information about the compromised system and its network environment. Crucially, it also establishes a reverse SSH tunnel. This creates a secure, encrypted connection from the compromised server back to an attacker-controlled server, allowing for more stable and covert command and control communication.
Targeting Russian Organizations: A Growing Trend
Kaspersky’s analysis indicates that Head Mare is actively running multiple campaigns targeting a diverse range of Russian organizations. These sectors include critical infrastructure and key industries such as instrumentation, electronics, transportation, energy, IT, and software development. This broad targeting suggests a strategic intent to impact various facets of the Russian economy and technological infrastructure.
The threat actor is not solely reliant on the TrueConf vulnerability for initial access. Researchers have observed the use of several other methods, including traditional phishing campaigns designed to trick users into revealing credentials or downloading malware. They also exploit publicly accessible web servers that may have their own unpatched vulnerabilities, and gain access through compromised contractors or third-party vendors who have legitimate access to target networks. This multi-pronged approach makes it more challenging to defend against their intrusions.
TrueConf Vulnerabilities: A Recurring Problem
The specific vulnerabilities exploited by Head Mare in this recent campaign are identified as affecting TrueConf Server versions 5.3.x prior to 5.3.9, 5.4.x prior to 5.4.9, 5.5.x prior to 5.5.5, and older, unpatched versions. TrueConf addressed these critical flaws by releasing patches in versions 5.3.9, 5.4.9, and 5.5.5, which were made available on June 18th. Organizations using TrueConf are strongly urged to apply these updates immediately to mitigate the risk of further exploitation.
This is not the first time TrueConf has been in the crosshairs of cyber attackers. In April 2026, Check Point Research reported on a separate campaign that exploited a zero-day arbitrary file execution flaw in TrueConf, tracked as CVE-2026-3502. This earlier incident also involved compromising users through trojanized client updates. Check Point dubbed that campaign "Operation True Chaos" and tentatively attributed it to Chinese threat actors associated with the Havoc implant, which was utilized in those attacks. The recurrence of such incidents underscores the persistent security challenges faced by software providers and the critical need for continuous vulnerability management and rapid patching.
Implications for the Enterprise and Government Sectors
The implications of Head Mare’s campaign are significant, particularly for the Russian enterprise and government sectors that rely on TrueConf for secure internal communications. The ability of attackers to distribute backdoored client installers through legitimate update channels creates a highly effective and insidious method of compromise. This bypasses many traditional perimeter defenses and relies on the trust users place in their internal IT infrastructure.
For government entities, the compromise of secure communication platforms can lead to the exfiltration of highly sensitive state secrets, strategic plans, and classified information. This could have profound national security consequences. In the enterprise sector, the theft of intellectual property, customer data, financial information, and proprietary trade secrets can result in substantial financial losses, reputational damage, and competitive disadvantage.
The use of advanced backdoors like PhantomCore and PhantomGraph suggests a motivated and well-resourced adversary, likely with state-sponsorship or strong ideological ties, given the "hacktivist" designation. The targeting of critical infrastructure sectors further amplifies the potential for disruptive impact. If these sectors’ communication and operational systems are compromised, it could lead to widespread service disruptions, economic instability, and even physical harm.
The reliance on unpatched software, especially in enterprise and government environments where legacy systems can be prevalent, remains a persistent weakness. The fact that these vulnerabilities were known and patched, yet continue to be exploited, highlights the ongoing challenge of timely software updates and robust patch management programs. Organizations must invest in comprehensive security strategies that include regular vulnerability scanning, penetration testing, and rapid deployment of security patches.
Furthermore, the exploitation of default configurations, such as open TCP ports without proper authentication, points to a need for more rigorous security hardening practices. Default settings are often designed for ease of use rather than maximum security, and organizations must actively review and reconfigure these settings to align with their specific security requirements.
The campaign also serves as a stark reminder of the evolving threat landscape and the sophistication of threat actors. The ability to not only gain initial access but also to establish persistent control, escalate privileges, and distribute malware through trusted channels demonstrates a high level of technical proficiency and strategic planning. This necessitates a proactive and adaptive approach to cybersecurity, incorporating threat intelligence, advanced detection capabilities, and rapid incident response mechanisms.
Recommendations for Defense and Mitigation
Organizations utilizing TrueConf or similar communication platforms should take immediate action:
- Patch Management: Ensure all TrueConf Server instances are updated to the latest available versions (5.3.9, 5.4.9, or 5.5.5 and later). Regularly review and apply security patches for all software and systems.
- Configuration Review: Audit network configurations, particularly for exposed ports like TCP 4307, and implement strict access controls and firewall rules to limit unauthorized access. Disable unnecessary services and ports.
- Endpoint Security: Deploy and maintain robust endpoint detection and response (EDR) solutions. Monitor for unusual process activity, unauthorized file modifications, and suspicious network connections. Ensure endpoint security software is up-to-date and configured to detect known and unknown threats.
- User Awareness Training: Conduct regular cybersecurity awareness training for all employees, emphasizing the risks of phishing, the importance of verifying software sources, and recognizing signs of malicious activity. Educate users about the risks associated with downloading software from untrusted sources, even if presented as an update.
- Network Segmentation: Implement network segmentation to limit the lateral movement of attackers within the network. If a TrueConf server is compromised, segmentation can prevent the threat from spreading to other critical systems.
- Threat Monitoring and Incident Response: Establish comprehensive threat monitoring capabilities and develop a well-defined incident response plan. Regularly test the incident response plan to ensure its effectiveness.
- Log Analysis: Implement robust logging and regularly analyze logs for signs of suspicious activity, such as failed login attempts, unusual user behavior, or unexpected file changes.
The Head Mare campaign against TrueConf servers underscores the critical importance of a layered security approach. Relying on a single security solution or assuming that internal systems are inherently secure is no longer a viable strategy. A proactive, vigilant, and continuously evolving security posture is essential to defend against the ever-present and increasingly sophisticated threats in the digital realm. The exploitation of communication platforms, especially those used by government and enterprise, represents a direct assault on the trust and operational integrity of organizations, demanding immediate and comprehensive remediation.
