Key Takeaways

  • Head Mare exploited unpatched TrueConf servers to distribute client installers containing PhantomCore and PhantomGraph backdoors.
  • The attackers obtained SYSTEM privileges, installed a persistent web shell, accessed databases, and targeted endpoint credentials.
  • Earlier exploitation of CVE-2026-3502 shows that TrueConf's on-premises update channel has faced repeated attacker interest in 2026.

Kaspersky has uncovered active attacks in which the Head Mare hacktivist group compromises unpatched TrueConf video conferencing servers and turns their trusted software distribution function against users. Instead of attacking every endpoint separately, Head Mare replaces the legitimate TrueConf Client installer with a trojanized package carrying the PhantomCore backdoor.

That is an efficient attack path. TrueConf is widely used by Russian government bodies and enterprises seeking an on-premises alternative to Zoom and Microsoft Teams. Users connecting to a familiar local server may reasonably expect an installer offered by that server to be legitimate. Once the server itself is compromised, however, that trust becomes a delivery mechanism.

Kaspersky discovered the activity in July. Its researchers said Head Mare connected to TrueConf Server through TCP port 4307, which is open by default, without authentication. The attackers then chained two vulnerabilities tracked internally as KLCERT-26-057 and KLCERT-26-058.

The first vulnerability allowed malicious script execution inside TrueConf's isolated environment. The second enabled a sandbox escape and command execution on the underlying operating system. Head Mare subsequently elevated privileges to NT AUTHORITY\SYSTEM and replaced \public\js\locale.php with a web shell, establishing persistent remote access.

From there, the operation moved beyond a conventional server breach. The web shell enabled collection of sensitive environmental data, access to the TrueConf database, and replacement of the hosted client installer. Employees connecting to the affected server could consequently receive a malicious, non-digitally signed update.

Exposure is not confined to businesses that operate TrueConf infrastructure themselves. Employees can join meetings hosted on a compromised counterparty's server and download an infected package. This creates a partner-risk problem, particularly for companies that routinely collaborate with contractors, suppliers, government agencies, or other outside parties.

Head Mare also deployed PhantomGraph, a separate backdoor composed of SysExcSvc.dll and SysReadSvc.dll. PhantomGraph receives commands through a Microsoft OneDrive account, executes them, and returns the results. Observed activity included reconnaissance commands such as hostname and whoami, creation of a reverse SSH tunnel, and dumping Local Security Authority Subsystem Service memory to obtain credentials.

This incident demonstrates that on-premises deployments do not eliminate supply-chain-style risks, but rather relocate part of that risk to customer-maintained infrastructure, where compromised internal update prompts can distribute malware.

The affected releases include TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and older versions. TrueConf fixed the two flaws in versions 5.3.9, 5.4.9, and 5.5.5, released on June 18. Enterprises running affected versions should prioritize upgrades, inspect locale.php for unauthorized changes, and investigate unexpected connections involving port 4307.

The campaign also follows earlier abuse of TrueConf's update path. The Hacker News reported that CVE-2026-3502, an arbitrary file execution flaw with a CVSS score of 7.8, was exploited during Operation True Chaos to push malicious software to connected endpoints. Check Point tentatively linked that campaign to Chinese threat actors using the Havoc implant.

CVE-2026-3502 is categorized as CWE-494, "Download of Code Without Integrity Check." Cybersecurity News reported that CISA added the flaw to its Known Exploited Vulnerabilities catalog on April 2, 2026, assigning federal agencies an April 16 remediation deadline.

For security leaders, patching is only part of the response. Teams should verify installer signatures, compare package hashes against trusted copies, review TrueConf server logs, hunt for the PhantomCore and PhantomGraph components, and reset credentials where LSASS access is suspected. Controls governing third-party meeting software also deserve attention, as conferencing servers can serve as both an initial foothold and a distribution hub for deeper compromise.