The persistent threat actor known as **Head Mare** has once again been observed weaponizing security flaws in unpatched **TrueConf** servers. These attacks, detected by Russian cybersecurity vendor **Kaspersky** in July 2026, are targeting a range of Russian companies across instrumentation, electronics, transport, energy, IT, and software development sectors. The attack campaign involves exploiting a chain of vulnerabilities in the **TrueConf** videoconferencing server to replace legitimate client installers with poisoned versions. These malicious installers then deliver the **PhantomCore** backdoor and remote access trojan (RAT) to vulnerable systems. ### TrueConf Vulnerabilities and Attack Chain The vulnerabilities, tracked as **KLCERT-26-057** and **KLCERT-26-058**, enable arbitrary code execution with elevated privileges. The attack impacts **TrueConf** server versions 5.3.x up to 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and earlier. The attack chain proceeds as follows: * Attackers connect to the **TrueConf** server on TCP port 4307, which is open by default. * Upon successful connection, the attackers exploit **KLCERT-26-057** to run a malicious script on the server. * The script initially launches within an isolated environment on the server, limiting its access to operating system functions. * The attackers then exploit **KLCERT-26-058** to break out of this isolated environment and run arbitrary commands on the underlying host. * Arbitrary code is executed on the server with **NT AUTHORITY\SYSTEM** privileges. * Finally, attackers replace the file "...\public\js\locale.php" with a web shell to establish persistent remote access to the compromised server. According to **Kaspersky**, this web shell is used to collect data on the IT infrastructure, gain privileged access to the **TrueConf** database, and ultimately substitute the original **TrueConf Client** distribution with an infected version containing **PhantomCore**. ### PhantomGraph Backdoor and Evasion Tactics The web shell also serves as a conduit for another backdoor, codenamed **PhantomGraph**. This malware shares some code overlap with **PhantomCore** and includes two DLL modules: * "SysExcSvc.dll," which receives commands and exfiltrates results back to **Microsoft OneDrive** cloud storage, used as a command-and-control (C2) channel. * "SysReadSvc.dll," which parses commands received by the first module, executes them, and stores the results. To establish persistence, the attackers execute a Base64-encoded PowerShell command that installs "SysExcSvc.dll" and "SysReadSvc.dll" as Windows services. **Kaspersky** suggests this two-component design is a deliberate tactic to hinder detection by **EDR** tools. Additionally, the threat actors have been observed launching an **SSH** reverse tunnel, taking a memory dump of the "lsass.exe" process, and collecting general system information using commands like `hostname` and `whoami`. **TrueConf** has since patched these vulnerabilities in server versions 5.3.9, 5.4.9, and 5.5.5, released on June 18, 2026. Organizations using **TrueConf** are strongly advised to update to the latest versions for optimal protection. This isn't the first time **Head Mare** has targeted zero-day flaws in **TrueConf** to attack Russian entities. Earlier in April, **Positive Technologies** disclosed that three vulnerabilities in the software (**BDU:2025-10114**, **BDU:2025-10115**, and **BDU-2025-10116**) were exploited by the group since September 2025 to deploy PHP web shells and malicious payloads for information theft and command execution. Around the same time, **Check Point** also reported that another high-severity security flaw in the **TrueConf** client (**CVE-2026-3502**) was exploited as a zero-day in a campaign targeting government entities in Southeast Asia to deploy the **Havoc C2** framework. ### HelloNet Hijacks ViPNet Update Mechanism These developments follow **Kaspersky**'s discovery of a new **APT**-style attack, ongoing since at least May 2026, which leverages previously unreported tooling. This campaign, dubbed **HelloNet**, primarily exploits the update mechanism for the **ViPNet** product suite to target Russian government, energy, transport, education, and logistics sectors. The **HelloNet** attack involves the execution of a malicious DLL, "wtsapi32.dll," which masquerades as a legitimate file associated with the **ViPNet** suite update system. This loader DLL, known as **HelloInjector**, is sideloaded by the **ViPNet** update binary "itcsrvup64.exe," leading to the execution of the malicious payload within "svchost.exe." **Kaspersky** detailed the loader's behavior: "After starting, the malware checks the process in the context of which it was launched. If the name of the main process is not svchost.exe, the loader starts iterating through all processes running in the operating system. It looks for a process whose name contains the string svchost, and whose command line contains the string netsvcs. If such a process is found, the loader injects itself into the target process using the NtWriteVirtualMemory and NtCreateThreadEx functions." Once restarted inside the new process, the loader performs a second check for "svchost" in the process name. If found, **HelloInjector** loads and executes the malicious payload stored in its body in plaintext. This payload, codenamed **HelloProxy**, functions as a hidden proxy and a loader for additional modules retrieved from a **C2** server. **HelloProxy** not only interferes with the normal functioning of user-mode security solutions designed to filter network connections but also serves as a loader for two additional components: * **HelloExecutor**, designed to execute commands on the infected system and launch an **SSH** tunnel to attacker infrastructure. * **HelloCleaner**, used to clean **ViPNet** software log files and erase forensic trails. A **Rust** implant named **HelloBackdoor**, capable of file uploads and downloads to and from the **C2** server, was also discovered on one of the infected systems. Commands that do not match a predefined format are interpreted as instructions to be executed via "cmd.exe." While the exact delivery mechanism for the rogue "wtsapi32.dll" DLL remains unclear, the activities have been tentatively linked to an unknown Chinese-speaking **APT** group. This attribution is based on references to the Chinese website sina[.]com and an open-source software download mirror ("mirrors.ustc.edu[.]cn") hosted by the University of Science and Technology of China. Given that fake updates for **ViPNet** have been exploited in previous attacks targeting Russia, these findings underscore how widely used programs within the country are becoming attractive vectors for advanced threat actors.