The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors. The attack, discovered by cybersecurity firm Kaspersky in July, leverages two critical flaws that allow the threat actor to execute arbitrary code with the highest level of privileges, ultimately deploying the PhantomCore and PhantomGraph backdoors. This campaign represents a significant evolution in supply-chain attacks, targeting a tool deeply embedded in the Russian enterprise and government sectors as a secure, on-premise alternative to Western platforms like Zoom and Microsoft Teams.
How Hackers Breach TrueConf Servers to Trojanize Client Installers
The intrusion chain begins with the exploitation of TCP port 4307, which is open by default on TrueConf servers and allows unauthenticated connections. Head Mare actors leveraged a vulnerability internally tracked by Kaspersky as KLCERT-26-057 to execute a malicious script within TrueConf’s isolated environment. A second flaw, KLCERT-26-058, enabled them to escape that sandbox and run commands directly on the underlying operating system. This two-step approach allowed the attackers to escalate privileges to NT AUTHORITY\SYSTEM, the highest level of access on a Windows system.
With these elevated privileges, the threat actor replaced the legitimate ‘\public\js\locale.php’ file with a web shell, ensuring persistent remote access to the compromised server. This web shell became the central pivot for further malicious activity, including data collection from the victim environment, access to the TrueConf database, and the critical step of replacing the legitimate TrueConf Client installer hosted on the server with a trojanized version containing the PhantomCore backdoor.
When employees of the targeted organization connect to their local TrueConf server to download updates, they receive this non-digitally signed, infected installer. The supply-chain mechanism is particularly insidious: any user connecting to a compromised TrueConf server, even from a different organization, can be served the malicious update. “Even if your organization does not use the TrueConf server, employees of the organization can connect to compromised counterparty TrueConf servers to participate in online meetings and download infected installation packages,” Kaspersky warns.
Understanding the Head Mare Threat Actor and Their Methods
Head Mare is a hacktivist group that has been active in campaigns targeting Russian organizations across multiple sectors, including instrumentation, electronics, transportation, energy, IT, and software development. Kaspersky reports observing multiple active campaigns from this group, indicating a sustained and resourced operation. Their initial access methods are diverse, encompassing phishing attacks, exploitation of vulnerabilities in public-facing web servers, and leveraging access via contractors. This varied approach demonstrates operational maturity and a willingness to adapt tactics to the target environment.
The choice of TrueConf as an attack vector is strategic. TrueConf is widely deployed in sectors where security and control are paramount, particularly within Russian government and enterprise networks that require an on-premise video conferencing solution. By compromising the update mechanism of this trusted tool, Head Mare gains a foothold inside networks that are otherwise difficult to penetrate. The victims are not just the organizations running the servers, but any user who trusts the updates served by those systems.
The PhantomCore and PhantomGraph Backdoors: Technical Details
The attack deploys two distinct backdoors. PhantomCore is delivered directly through the trojanized client installer. When a user installs or updates their TrueConf client from the compromised server, PhantomCore is embedded in their system. The second backdoor, PhantomGraph, is a separate tool consisting of two DLL files: SysExcSvc.dll and SysReadSvc.dll. PhantomGraph uses a novel command-and-control channel by accepting instructions via a Microsoft OneDrive account, executing them, and returning the results to the attackers.
Observed activities through PhantomGraph are highly destructive. The malware has been used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process, a technique that extracts hashed or plaintext credentials from the system. This credential theft allows the attackers to move laterally across the network. PhantomGraph also executes standard reconnaissance commands like ‘hostname’ and ‘whoami’ to map the infected environment and initiates a reverse SSH tunnel, providing persistent, encrypted remote access to the compromised system for manual exploitation.
What Are the Specific TrueConf Vulnerabilities Exploited?
Two specific vulnerabilities were observed in the Head Mare attacks. Kaspersky tracked them internally as KLCERT-26-057 and KLCERT-26-058. The first flaw allowed remote code execution within TrueConf’s restricted environment, while the second permitted a sandbox escape to run code on the host operating system. The affected software versions are TrueConf Server 5.3.x before version 5.3.9, 5.4.x before version 5.4.9, 5.5.x before version 5.5.5, and all older versions. TrueConf released patches in versions 5.3.9, 5.4.9, and 5.5.5 on June 18, approximately one month before Kaspersky publicly disclosed the campaign.
This is not the first time TrueConf has been targeted through its update mechanism. In April 2026, CheckPoint Research reported a campaign named ‘Operation True Chaos,’ which exploited a separate zero-day arbitrary file execution flaw in TrueConf, tracked as CVE-2026-3502. CheckPoint attributed that campaign tentatively to Chinese threat actors using the Havoc implant. The recurrence of supply-chain attacks against TrueConf underscores the high value of this vector and the persistent interest from multiple advanced threat actors.
How Organizations Can Defend Against Trojanized Software Updates
Defending against this class of attack requires a multi-layered approach. The most immediate step is patching. Organizations using TrueConf Server must update to versions 5.3.9, 5.4.9, or 5.5.5 or later to close the known vulnerabilities. However, patching alone is insufficient, as similar zero-day vulnerabilities could be discovered in the future. Administrators should restrict outbound connectivity from the TrueConf server to the minimum required for operation and monitor for unusual processes or network connections originating from the server.
For client machines, verifying the digital signature of installer files before execution is a critical control. The trojanized installers in this campaign were not digitally signed, which is a significant red flag. Security teams should implement application control policies that block the execution of unsigned executables from software update directories. Additionally, monitoring for the specific DLL files SysExcSvc.dll and SysReadSvc.dll, or for anomalous communication to Microsoft OneDrive from internal systems, can indicate a PhantomGraph infection. Network segmentation that prevents TrueConf servers from directly communicating with clients on privileged ports can also limit the blast radius of a compromise.
Strategic Significance of the Head Mare TrueConf Campaign
This campaign highlights a dangerous trend in modern cyber warfare: the weaponization of trusted software update channels. By compromising the supply chain at the server level, Head Mare gains the ability to distribute malware to every client that trusts that server, bypassing traditional network defenses. The use of a legitimate service like Microsoft OneDrive for command and control is also a sophisticated evasion technique, as traffic to known cloud providers is often permitted by security policies.
The targeting of Russian organizations by a hacktivist group adds a geopolitical dimension to the technical attack. The sectors affected—energy, transportation, electronics, and government—are typical targets for politically motivated disruption and intelligence gathering. The combination of credential theft, persistent backdoor access, and reconnaissance capabilities suggests the attackers have long-term access objectives beyond a single disruptive event. The fact that multiple active campaigns are ongoing indicates that this is not a one-off operation but a sustained effort.
Organizations that rely on on-premise collaboration tools must recognize that the security of their software supply chain is only as strong as the weakest server in their ecosystem. A single unpatched TrueConf server can become a distribution point for malware affecting numerous users and partner organizations. The attacks demonstrate that threat actors are willing to invest in compromising the update mechanisms of even niche software if it provides access to high-value networks. For security teams, the lesson is clear: assume that any software update can be compromised and implement verification and isolation controls accordingly.
