Attackers Compromise TrueConf Servers to Distribute Backdoored Client Installers

Attackers linked to the Head Mare hacktivist group have compromised unpatched TrueConf video-conferencing servers and used them to distribute tampered client installers, according to research from Kaspersky.

The campaign, observed in July 2026, targeted TrueConf servers used by organizations in Russia. TrueConf is an on-premises conferencing platform widely deployed by government and enterprise customers. Kaspersky said the attackers exploited two vulnerabilities to gain code execution, escape the application’s isolated environment and run commands on the host operating system with NT AUTHORITY\SYSTEM privileges.

The flaws, tracked internally by Kaspersky as KLCERT-26-057 and KLCERT-26-058, were reportedly reachable through TCP port 4307, which is enabled by default. After gaining access, the attackers replaced a TrueConf server file with a web shell, providing persistent access and allowing them to gather information from the environment and access the product’s database.

They also replaced the legitimate TrueConf Client installer hosted on compromised servers with a malicious, unsigned package containing the PhantomCore backdoor. Users connecting to an affected server could then receive the altered installer as an update. Kaspersky warned that employees may be exposed even when their own organization does not operate TrueConf, since they could connect to a compromised partner’s server to join a meeting or download software.

Additional backdoor activity

The attackers deployed a second implant, PhantomGraph, made up of two DLL files named SysExcSvc.dll and SysReadSvc.dll. The malware uses a Microsoft OneDrive account to receive commands and send back results.

Observed activity included system discovery using commands such as hostname and whoami, creation of a reverse SSH tunnel, and memory access targeting the LSASS process, a technique that can expose Windows credentials.

Kaspersky said it has identified campaigns against organizations in instrumentation, electronics, transportation, energy, information technology and software development. Initial access has also involved phishing, attacks against public-facing web servers and compromised contractors.

TrueConf addressed the reported issues in versions 5.3.9, 5.4.9 and 5.5.5, released June 18. Earlier, Check Point Research reported a separate TrueConf zero-day, CVE-2026-3502, used to deliver trojanized updates in a campaign it called Operation True Chaos. Organizations should update supported servers, verify installer signatures and inspect systems for unauthorized web shells or unusual OneDrive and SSH activity.