Head Mare Exploits TrueConf Server Flaws to Replace Client Installers with PhantomCore Backdoor

Russian cybersecurity vendor Kaspersky has uncovered a new attack campaign by the threat actor known as Head Mare, targeting unpatched TrueConf videoconferencing servers. The attacks, detected in July 2026, target Russian companies across instrumentation, electronics, transport, energy, IT, and software development sectors.

The attackers exploit a chain of two vulnerabilities, tracked as KLCERT-26-057 and KLCERT-26-058, to achieve arbitrary code execution with elevated privileges on TrueConf Server versions 5.3.x up to 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and earlier. The attack begins by connecting to the server on TCP port 4307, which is open by default. The first flaw allows running a malicious script in an isolated environment, while the second enables breaking out of that environment to execute arbitrary commands on the underlying host with NT AUTHORITYSYSTEM privileges.

Once compromised, the attackers replace the legitimate file …publicjslocale.php with a web shell to maintain persistent remote access. This web shell is used to collect infrastructure data, gain privileged access to the TrueConf database, and ultimately replace the original TrueConf Client installer with a poisoned version that delivers the PhantomCore backdoor and remote access trojan (RAT). Additionally, the web shell serves as a conduit for another backdoor called PhantomGraph, which shares code overlap with PhantomCore. PhantomGraph consists of two DLL modules: SysExcSvc.dll for receiving commands and exfiltrating results to Microsoft OneDrive (used as C2), and SysReadSvc.dll for parsing and executing commands. The attackers install these DLLs as Windows services via a Base64-encoded PowerShell command, deliberately splitting the malware into two components to evade EDR detection.

Further malicious activities include launching an SSH reverse tunnel, dumping the memory of the lsass.exe process, and collecting system information using commands like hostname and whoami.

The vulnerabilities were patched by TrueConf in versions 5.3.9, 5.4.9, and 5.5.5 released on June 18, 2026. Organizations using TrueConf are strongly advised to update to the latest versions immediately.

This is not the first time Head Mare has exploited TrueConf flaws. In April 2026, Positive Technologies disclosed three vulnerabilities (BDU:2025-10114, BDU:2025-10115, BDU-2025-10116) abused by the group since September 2025 to deliver PHP web shells and malicious payloads. Additionally, Check Point reported that CVE-2026-3502, a high-severity flaw in the TrueConf client, was exploited as a zero-day in campaigns targeting government entities in Southeast Asia to deploy the Havoc C2 framework.

The article also mentions a separate APT-style attack discovered by Kaspersky, dubbed HelloNet, which abuses the update mechanism of the ViPNet product suite to target Russian government, energy, transport, education, and logistics sectors. This attack uses a malicious DLL (wtsapi32.dll) sideloaded by the ViPNet update binary itcsrvup64.exe, leading to the execution of HelloInjector and HelloProxy. The campaign is attributed to an unknown Chinese-speaking APT with low confidence.