Kaspersky has disclosed an active campaign by the hacktivist group Head Mare that turns unpatched TrueConf Server videoconferencing deployments into a distribution point for backdoored client software. Rather than phishing end users directly, the attackers compromise the server infrastructure that legitimate clients trust to fetch their own updates — poisoning the installer at the source.

What Happened

Head Mare targets TrueConf Server instances that haven’t been patched since June. The group connects unauthenticated to TCP port 4307, which TrueConf Server leaves open by default, and chains two flaws internally tracked by Kaspersky’s CERT as KLCERT-26-057 and KLCERT-26-058. The first lets the attacker execute a malicious script inside TrueConf’s sandboxed application environment; the second escapes that sandbox to run arbitrary commands on the underlying Windows host, escalating straight to NT AUTHORITY\SYSTEM.

With SYSTEM access, the operators overwrite \public\js\locale.php with a web shell, giving them persistent remote control of the server independent of the original vulnerability chain. From there they replace the legitimate TrueConf Client installer — the file every connecting user downloads to install or update the desktop app — with a trojanized, unsigned build. Any employee who connects to the compromised server and installs or updates the client receives the backdoor instead of the real application.

Technical Details

The trojanized installer deploys two implants:

  • PhantomCore — a DLL-based backdoor that performs host reconnaissance, dumps credentials from LSASS memory, and maintains command-and-control communication with the operators.
  • PhantomGraph — a companion backdoor that uses Microsoft OneDrive as its C2 channel, blending exfiltration and tasking traffic into normal cloud-storage activity and complicating network-based detection.

Kaspersky first observed the activity in July 2026. The exploited flaws affect TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and earlier branches; TrueConf shipped fixes in 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026. Servers still running pre-patch builds — and any client that trusted an installer served from one — remain exposed. No public CVE has been assigned to either flaw; both exist only under Kaspersky’s internal KLCERT identifiers, which raises the usual visibility problem for organizations that scan purely by CVE ID and would miss this chain entirely.

Impact

The campaign has focused on Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development — sectors where TrueConf’s on-premises videoconferencing is common in environments air-gapped or restricted from mainstream Western collaboration tools. Because the trojanized installer is delivered through what looks like a routine, expected update from the organization’s own server, the attack sidesteps user training aimed at phishing and untrusted downloads: victims are getting malware from infrastructure they already trust. Combined with LSASS credential dumping and SYSTEM-level server compromise, a single unpatched TrueConf deployment can cascade into domain-wide credential theft and lateral movement well beyond the videoconferencing tool itself.

Mitigation

  • Patch TrueConf Server to 5.3.9, 5.4.9, 5.5.5, or later immediately; do not treat this as low-priority because no CVE was assigned.
  • Restrict or firewall inbound access to TCP 4307 — it is open by default and requires no authentication to reach the vulnerable code path.
  • Audit \public\js\locale.php and other web-accessible server files for unexpected modifications indicating a planted web shell.
  • Verify the digital signature of every TrueConf Client installer before deployment; the trojanized builds are unsigned, and enforcing signature checks at the endpoint or via software restriction policy blocks the payload outright.
  • Source TrueConf Client installers only from the vendor’s official distribution channel rather than pulling them from an internal server whose integrity can’t be independently confirmed.
  • Hunt for PhantomGraph’s OneDrive-based C2 traffic and PhantomCore’s LSASS access patterns on endpoints that recently installed or updated TrueConf Client; treat any match as a full credential-compromise incident requiring rotation, not just malware removal.

Sources