**TrueConf**, a popular video conferencing solution favored by Russian enterprise and government sectors for its on-premise security, is at the center of a new wave of attacks. The **Head Mare** hacktivist group has been observed exploiting unpatched servers to distribute backdoored client installers. ### Exploiting Critical Vulnerabilities Cybersecurity firm **Kaspersky** discovered the ongoing campaign in July. Attackers leveraged specific vulnerabilities to achieve arbitrary code execution with the highest privileges. They exploited **KLCERT-26-057** to run malicious scripts within **TrueConf**'s isolated environment and **KLCERT-26-058** to escape the sandbox and execute commands on the underlying operating system. Initial access was gained via **TCP port 4307**, which is open by default on **TrueConf** servers and allowed unauthenticated connections. Following privilege escalation to `NT AUTHORITY\SYSTEM`, the attackers replaced the `\public\js\locale.php` file with a web shell, ensuring persistent remote access to the compromised server. ### The Backdoor Delivery Mechanism **Head Mare** utilizes the web shell to conduct reconnaissance, access the **TrueConf** database, and, crucially, replace the legitimate **TrueConf Client** installer with a trojanized version containing the **PhantomCore** backdoor. Organizations connecting to their local **TrueConf** server then receive this malicious, unsigned client installer as an update. **Kaspersky** warns that even organizations not directly using a **TrueConf** server could be at risk if their employees connect to a compromised counterparty's **TrueConf** server for meetings, potentially downloading infected installation packages. ### PhantomGraph: A Second Layer of Compromise Beyond **PhantomCore**, **Head Mare** also deploys **PhantomGraph**, a separate backdoor comprising two DLL files: `SysExcSvc.dll` and `SysReadSvc.dll`. This sophisticated backdoor communicates via a **Microsoft OneDrive** account, receiving commands, executing them, and returning results. Observed activities include dumping the memory of the Local Security Authority Subsystem Service (**LSASS**) process to exfiltrate credentials, reconnaissance commands like `hostname` and `whoami`, and the establishment of reverse SSH tunnels. ### Widespread Targeting and Previous Incidents **Kaspersky** is currently tracking multiple active **Head Mare** campaigns targeting Russian organizations across various sectors, including instrumentation, electronics, transportation, energy, IT, and software development. The threat actor employs several initial access methods, including phishing, exploiting public-facing web servers, and supply chain attacks via contractors. These vulnerabilities affect **TrueConf Server 5.3.x before 5.3.9**, **5.4.x before 5.4.9**, **5.5.x before 5.5.5**, and older versions. **TrueConf** released patches in versions **5.3.9**, **5.4.9**, and **5.5.5** on June 18. This is not the first time **TrueConf** has faced such threats. In April 2026, **CheckPoint Research** reported on 'Operation True Chaos,' where hackers exploited a zero-day arbitrary file execution flaw (**CVE-2026-3502**) in **TrueConf** to push malicious software updates, tentatively attributing the campaign to Chinese threat actors utilizing the **Havoc** implant.