Head Mare hackers broke into unpatched TrueConf video conferencing servers and swapped the legitimate TrueConf Client installer for a trojanized, unsigned version carrying the PhantomCore backdoor. Kaspersky discovered the campaign in July. Employees who connected to their organization's local TrueConf server received the malicious package as a routine client update. (Source: BleepingComputer)
TrueConf is an on-premise unified communications platform used heavily across Russian enterprise and government environments as an internally hosted alternative to Zoom and Microsoft Teams. That on-premise design is exactly what makes this compromise matter to you: the update your staff trusts comes from a server inside your own perimeter, so the usual instinct to question downloads from unfamiliar internet sources never triggers. The installer arrives unsigned, from an expected source, at an expected time.
The exposure extends past organizations that run TrueConf themselves.
"Even if your organization does not use the TrueConf server, employees of the organization can connect to compromised counterparty TrueConf servers to participate in online meetings and download infected installation packages," Kaspersky warns.
That means a supplier, client, or partner with an unpatched server becomes an infection path into your endpoints through a normal meeting invitation. The affected builds are TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and older releases, with fixes published on June 18.
This is the second time in 2026 that TrueConf client distribution has been abused. In April, CheckPoint Research documented attackers exploiting CVE-2026-3502, an arbitrary file execution zero-day, to push trojanized client updates carrying the Havoc implant — a campaign CheckPoint named "Operation True Chaos" and tentatively attributed to Chinese threat actors. Two separate actor sets have now treated the same update channel as a delivery mechanism, which tells you the software distribution point deserves the same scrutiny you give your internet-facing servers.
Attack Chain: From Trojanized Installer to Persistent Access
The intrusion starts on TCP port 4307, which TrueConf Server exposes by default and which accepts connections without authentication. Kaspersky found Head Mare reaching the service directly over that port, so no credential theft or phishing was needed for the first stage of the server compromise.
From there the attackers chained two flaws that Kaspersky tracks internally as KLCERT-26-057 and KLCERT-26-058. The first executes a malicious script inside TrueConf's isolated execution environment; the second escapes that sandbox and runs commands on the underlying Windows operating system.
Both flaws affect TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and older releases. The vendor shipped fixes in 5.3.9, 5.4.9, and 5.5.5 on June 18, which places every unpatched server in a window that attackers were already using.
After the sandbox escape, the operators raised privileges to NT AUTHORITY\SYSTEM — the highest local account on a Windows host (ATT&CK T1068). They then overwrote the file \public\js\locale.php with a web shell, planting persistent remote access inside a legitimate application directory where a PHP file does not look out of place (T1505.003).
The web shell became the operator console. Kaspersky observed it used to collect sensitive information from the victim environment, query the TrueConf database, and replace the hosted TrueConf Client installer with a build carrying the PhantomCore backdoor. Database access on a conferencing server means meeting records, account details, and directory data are readable by the intruder before any endpoint is touched.
The replacement installer is not digitally signed, which is the single clearest artifact for anyone reviewing packages pulled from an internal server (T1195.002, supply chain compromise). Endpoints that accept the update run attacker-controlled code with installer-level privileges.
Separately, Head Mare deploys PhantomGraph, a backdoor built from two DLLs: SysExcSvc.dll and SysReadSvc.dll. The pair receives commands through a Microsoft OneDrive account, executes them, and writes results back to the same account — command-and-control over a sanctioned cloud service that blends with normal Office traffic (T1102, web service C2).
Post-exploitation activity through PhantomGraph included dumping the memory of the LSASS process (T1003.001), the Windows component that holds credential material for logged-on accounts. Credentials harvested this way let the operators authenticate as real users, which is why follow-on movement in these intrusions rarely trips password-based alerting.
Kaspersky also recorded basic host reconnaissance through the backdoor — hostname and whoami (T1082, T1033) — and the establishment of a reverse SSH tunnel back to attacker infrastructure (T1572). That tunnel gives interactive access to internal hosts from outside the network without an inbound firewall change.
This is the second cluster to abuse TrueConf client updates. In April 2026, CheckPoint Research documented Operation True Chaos, which exploited CVE-2026-3502, a zero-day arbitrary file execution flaw, to compromise users through trojanized client updates and deliver the Havoc implant. CheckPoint tentatively attributed that activity to Chinese threat actors, separate from Head Mare.
The reporting does not publish hashes, domains, or IP addresses. The usable indicators for your hunt are the file-level artifacts: a modified \public\js\locale.php, the presence of SysExcSvc.dll or SysReadSvc.dll, unsigned TrueConf Client packages, and outbound OneDrive or SSH sessions from servers that have no business making them.
Kaspersky reports multiple concurrent Head Mare campaigns against Russian organizations in instrumentation, electronics, transportation, energy, IT, and software development, with initial access also coming from phishing, exploitation of public-facing web servers, and access through contractors.
Targeting and Attribution: Head Mare and the Separate True Chaos Campaign
Two separate intrusion sets have hit the same product in 2026, and they are not the same operation. Kaspersky attributes the current campaign to Head Mare, a hacktivist group focused on Russian organizations. CheckPoint Research, in April 2026, documented an earlier campaign it called Operation True Chaos, which abused a zero-day arbitrary file execution flaw tracked as CVE-2026-3502 and was tentatively attributed to Chinese threat actors associated with the Havoc implant.
The Havoc link is worth stating precisely. Havoc is the post-exploitation implant seen in the True Chaos intrusions, and CheckPoint used its presence as one basis for a tentative attribution. Tentative means exactly that — the same tooling appears across multiple operators, so the implant identifies the payload rather than confirming the sponsor.
Head Mare's current targeting is broader than a single vertical. Kaspersky reports multiple active campaigns running against Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development. That mix covers industrial engineering and the vendors who supply it, which means a compromise at one supplier gives access to the meeting infrastructure of everyone who dials into it.
Initial access is not limited to the video conferencing server. Kaspersky observed Head Mare using several entry paths in parallel:
- Phishing (MITRE ATT&CK T1566) against employees
- Exploitation of public-facing web servers (T1190)
- Access through contractors — a trusted relationship path (T1199) where the attacker enters via a third party that already has legitimate connectivity
The contractor route matters for your vendor risk process. An intrusion that begins at an outsourced IT provider or an integrator arrives inside the trust boundary you already granted, so identity and network controls that assume "internal equals safe" do not apply.
The second backdoor in this campaign, PhantomGraph, shows what the group does after establishing a foothold. It ships as two DLL files — SysExcSvc.dll and SysReadSvc.dll — that pull commands from a Microsoft OneDrive account, run them, and write results back to the same account. Command and control over a legitimate cloud storage service (T1071.001, T1102) blends with normal Office traffic, so perimeter egress filtering based on domain reputation will not flag it.
Observed PhantomGraph activity includes dumping the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials (T1003.001). Kaspersky also recorded basic host discovery through hostname and whoami (T1082, T1033), and the establishment of a reverse SSH tunnel (T1572) for interactive access back into the network. Credentials pulled from LSASS let the operator authenticate to file shares, mail, and domain services as a real employee, which is why post-compromise activity in these cases often looks like ordinary administrative work in your logs.
The choice of a conferencing platform as the delivery point follows from what that platform holds and does. The server stores a user database and acts as the software distribution channel for every endpoint that connects to it, so one compromise yields both an identity directory and a signed-update-shaped path onto workstations. Communications infrastructure also carries meeting content and participant lists across organizational boundaries, which is direct collection value for an actor interested in who talks to whom.
For defenders assessing exposure, the practical takeaway from attribution is that two unrelated groups independently identified the same product as a distribution point within months of each other. On-premise collaboration servers are being treated as an access route into downstream organizations, and the tooling deployed afterward is credential-focused.
Business and Operational Impact
The most direct loss here is credential confidentiality. Head Mare used the PhantomGraph backdoor to dump the memory of the LSASS process, the Windows component that holds authentication material for every account logged into that machine. Once those credentials leave your network, an attacker can authenticate to file shares, mail, and management consoles as your own staff, and the resulting activity looks legitimate in your logs.
PhantomGraph also opens a reverse SSH tunnel and takes its commands through a Microsoft OneDrive account. That means the command-and-control traffic from your compromised hosts blends with ordinary cloud storage traffic your employees generate all day, so egress filtering that blocks unknown domains will not stop it.
Consider what the video conferencing server itself holds. Kaspersky reports the attackers used their web shell to collect sensitive information from the victim environment and to access the TrueConf database — the directory of your users, their accounts, and the internal structure of who talks to whom. For a firm in instrumentation, electronics, transportation, energy, IT, or software development, all sectors Kaspersky names as currently targeted, that is a map of your engineering teams, your executives, and your project groupings.
The integrity problem runs deeper than the individual endpoints. Your conferencing platform is infrastructure your staff trusts by policy, and the attacker held NT AUTHORITY\SYSTEM on it. Any recovery you attempt has to assume the server distributed unsigned software to an unknown number of your users over an unknown period, which turns a server rebuild into an endpoint-by-endpoint investigation.
Third-party exposure is the part most organizations underestimate.
Your procurement team, your outside counsel, your contract manufacturers — each meeting invitation from a partner running its own TrueConf instance is a path into your laptops. You inherit the risk without ever having deployed the product, and your vendor questionnaires almost certainly do not ask about it.
That flows in both directions. Kaspersky lists access via contractors among Head Mare's initial access methods alongside phishing and exploitation of public-facing web servers, so a compromised supplier can become your entry point, and your compromised server can become theirs.
On the compliance side, a conferencing platform touches categories of data that most regulators treat seriously:
- Recorded or live discussions containing personal data, which brings GDPR notification duties into play for organizations handling EU residents' information
- Clinical or patient discussions held over video, which fall under HIPAA for covered entities and their business associates
- Contractual confidentiality obligations to clients and partners whose representatives joined meetings on the affected server
The credential theft compounds those obligations. When LSASS material is taken, you cannot easily scope the breach to the conferencing system alone, and regulators generally expect notification decisions based on what the attacker could reach, not only on what you can prove they touched.
Financially, the costs land in incident response hours, forced password and Kerberos ticket resets across the domain, endpoint reimaging, and legal review of notification duties for every counterparty whose employees joined a meeting on your server.
Detection and Immediate Response Actions
Within the first few hours
Verify the digital signature on every TrueConf Client installer in your environment before you do anything else. The trojanized package Head Mare distributed is unsigned, so a quick Get-AuthenticodeSignature run against the installer hosted on your server and against any cached copies on workstations gives you a fast pass/fail on whether staff received a tampered build.
Next, check the server-side web root. The attackers overwrote \public\js\locale.php with a web shell, so compare that file against a known-good copy from the vendor package and pull the modification timestamp. Web server access logs showing POST requests to that path, particularly from external addresses, indicate the shell was used rather than merely planted.
Then sweep endpoints for the two loader DLLs, SysExcSvc.dll and SysReadSvc.dll. Enumerate registered services and loaded modules across your fleet, and flag any host where those names appear regardless of directory. Pair that with a process-ancestry hunt:
- TrueConf server processes spawning
cmd.exeorpowershell.exe - Execution of
hostnameandwhoamifrom a service context on a conferencing server - Any SSH client binary opening outbound sessions from a Windows server that has no administrative reason to do so
- Process access handles opened against
lsass.exeby non-security tooling
On the network side, look for Microsoft OneDrive and Graph traffic originating from servers and from hosts that never touch consumer cloud storage. That traffic carries the command channel, and its legitimacy at the protocol level is why source-host context matters more than destination reputation here.
Within 24 to 48 hours
If any indicator confirms, isolate the host at the network layer and leave it powered on. Capture a memory image first, then a disk image — the credential material and the tunnel configuration live in volatile memory, and a shutdown discards both.
Treat every account that held an interactive or service logon on a confirmed host as exposed. Reset those passwords, rotate service account credentials, revoke active sessions and refresh tokens, and reset the krbtgt account twice if a domain controller or domain-joined server is involved. Adlumin ITDR, deployed in the environments Capstone manages, correlates the authentication events that follow credential theft — logons from new hosts, unusual service-account activity, impossible-travel patterns — so reused credentials surface as alerts instead of routine successful logins.
Rebuild the TrueConf server from clean media. The attackers held SYSTEM-level access and database access, so cleaning individual artifacts leaves too much room for a missed persistence mechanism.
Longer term
Patch to the fixed branch builds the vendor released on June 18: 5.3.9, 5.4.9, and 5.5.5, matched to whichever 5.3.x, 5.4.x, or 5.5.x line you run. Restrict TCP 4307 so it is reachable only from your internal management range, and confirm the restriction with an external port scan rather than a firewall rule review.
Enforce publisher-based application allowlisting through WDAC or AppLocker so unsigned installers cannot execute even when they arrive through a trusted internal update path. Extend that rule to installers pulled from partner and counterparty conferencing servers, since your staff may join meetings hosted outside your perimeter and download client packages from those systems.
Finally, document which vendors and clients host their own TrueConf servers and confirm each has applied the June 18 builds before your people connect again.
Patching and Remediation Strategy
Upgrade the server before you touch a single workstation. TrueConf fixed both flaws in versions 5.3.9, 5.4.9, and 5.5.5, released on June 18, and anything running an earlier build in the 5.3.x, 5.4.x, or 5.5.x branches — or older still — remains exploitable. Cleaning endpoints while the distribution point is still vulnerable just gives the attacker a second chance to push the same package.
Pull the upgrade package directly from TrueConf's official distribution channel and check it against the vendor's published checksum and code signature before you run it. If your team keeps a local mirror of installers on a file share or software deployment server, treat that mirror as suspect too and repopulate it from the vendor source rather than from the compromised host.
Separately, confirm with the vendor that your target build carries the fix for CVE-2026-3502, the arbitrary file execution flaw CheckPoint documented in April 2026. That is a different bug from the pair used in this campaign, and it was also abused to deliver trojanized client updates. Patching one does not automatically close the other if your appliance sat on an old branch through both disclosure windows.
On the client side, remove and reinstall rather than repair. An in-place update over a trojanized package leaves the backdoor's files behind. The sequence that works:
- Uninstall the existing TrueConf Client from every affected workstation and delete the cached installer from the local download or update directory.
- Search all endpoints for
SysExcSvc.dllandSysReadSvc.dll, the two components of the PhantomGraph backdoor, and for any service or autostart entry that loads them. - Reinstall from the verified vendor media only after the server has been upgraded, so clients pull a clean, signed package.
- Rotate credentials for every account that logged into a machine where those files appeared, including service accounts and any domain admin session.
Two rollback risks deserve attention before you schedule the work. Restoring a TrueConf server from a snapshot taken before the upgrade reinstates both the vulnerable code and any attacker-placed files that existed at snapshot time, so pick your restore point by date against Kaspersky's July discovery, not by convenience. And because the server is the sole distribution point for client updates, the upgrade window takes internal video conferencing offline — book it deliberately and tell staff in advance, since a surprise outage tends to push people onto unmanaged consumer tools.
SentinelOne blocks and quarantines the PhantomGraph DLL loads and the LSASS memory access described earlier across managed environments, which gives you a rollback-safe record of which endpoints actually executed the trojanized installer instead of merely receiving it.
Verify the cleanup rather than assuming it. After reinstalling, inspect running processes and loaded modules on a sample of remediated machines for anything referencing the two DLL names, and confirm no unexpected outbound SSH sessions persist. Compare current outbound traffic against your pre-incident baseline, paying attention to cloud storage endpoints that were not in normal use before July. Re-check the upgraded server's version string against the fixed releases, and repeat the signature check on the client installer it now serves to confirm it is signed and matches the vendor package.
Key Takeaway: Verify Installer Integrity Before Deployment
The lesson from this campaign is narrow and practical: the software your staff installs is only as trustworthy as the server handing it to them. An internal distribution point sits inside your perimeter, carries your own hostname, and gets treated as authoritative by every employee who clicks the update prompt. That trust is what the attackers monetized.
Treat every installer as an artifact that has to prove itself, regardless of where it came from. The single most important control is cryptographic verification before deployment — confirm the publisher signature and compare the file hash against the value the vendor publishes on its own channel. If either check fails, the package does not run.
Write that into policy rather than leaving it to individual judgment. A short standing rule covering all third-party software acquisition — signature required, hash matched against vendor-published values, verification recorded before the package reaches production — turns an ad hoc habit into something you can audit. Your software inventory should also record where each package originated, because you cannot verify a source you never wrote down.
Extend the same expectation outward. Your employees join meetings hosted by clients, suppliers, and partners, and those sessions can prompt a client download from infrastructure you have no visibility into and no authority to patch. Managed endpoint controls that block unsigned executables give you coverage where policy alone cannot reach.
Trojanized installers work because they arrive through the channel your users are trained to accept. Software integrity checking is what separates a legitimate update from a delivery mechanism, and it belongs in the same routine as patching and asset tracking.
