Hackers are exploiting vulnerabilities in TrueConf video conferencing servers to distribute malicious client installers containing backdoors, according to research from Kaspersky. The attacks, attributed to a group named Head Mare, leverage two specific flaws, internally tracked as KLCERT-26-057 and KLCERT-26-058, to achieve arbitrary code execution and privilege escalation, ultimately leading to the deployment of PhantomCore and PhantomGraph backdoors.
TrueConf, a video conferencing solution popular in Russia, particularly within government and enterprise sectors, is often used as an on-premise alternative to Western platforms. Kaspersky researchers identified the campaign in July, noting that Head Mare exploits TCP port 4307, which is open by default on TrueConf servers, to connect without authentication.
The attack chain involves using KLCERT-26-057 to execute a malicious script within TrueConf's isolated environment, followed by KLCERT-26-058 to escape the sandbox and run commands on the underlying operating system. Attackers then escalate privileges to NT AUTHORITY\SYSTEM and replace the `\public\js\locale.php` file with a web shell, establishing persistent remote access.
This web shell is used to gather sensitive information, access the TrueConf database, and replace the legitimate TrueConf Client installer with a trojanized version containing the PhantomCore backdoor. When users connect to a compromised local TrueConf server, they receive this non-digitally signed, malicious client installer as an update. Kaspersky warns that even organizations not directly using a TrueConf server can be affected if their employees connect to compromised third-party TrueConf servers for meetings and download the infected packages.
In addition to PhantomCore, Head Mare deploys PhantomGraph, a separate backdoor comprising two DLL files, `SysExcSvc.dll` and `SysReadSvc.dll`. PhantomGraph communicates via a Microsoft OneDrive account, executing commands and returning results. Observed activities include dumping the memory of the Local Security Authority Subsystem Service (LSASS) process to exfiltrate credentials, performing reconnaissance commands like `hostname` and `whoami`, and initiating reverse SSH tunnels.
Kaspersky is currently observing multiple active Head Mare campaigns targeting Russian organizations across various sectors, including instrumentation, electronics, transportation, energy, IT, and software development. The threat actor employs several initial access methods, including phishing, exploiting public-facing web servers, and gaining access through contractors.
The vulnerabilities exploited by Head Mare affect TrueConf Server versions 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and older releases. TrueConf released patches for these flaws on June 18, in versions 5.3.9, 5.4.9, and 5.5.5.
This incident follows a report from April 2026 by CheckPoint Research, which detailed a separate campaign, "Operation True Chaos," targeting a zero-day arbitrary file execution flaw in TrueConf, identified as CVE-2026-3502. That campaign also involved compromising users via trojanized client updates and was tentatively attributed to Chinese threat actors utilizing the Havoc implant.
