TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore
Head Mare exploits TrueConf server flaws to install web shells and deliver PhantomCore and PhantomGraph backdoors at Russian organizations.
Kaspersky detected July 2026 attacks by the threat actor Head Mare exploiting a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf videoconferencing servers. The chain enables arbitrary code execution with SYSTEM privileges, deployment of a web shell at locale.php, and replacement of client installers with versions delivering the PhantomCore backdoor and PhantomGraph, which uses Microsoft OneDrive as C2. Targets span Russian instrumentation, electronics, transport, energy, IT, and software firms. Patches shipped in TrueConf Server 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026.
- Attack exploits TCP port 4307 and a two-flaw chain for SYSTEM-level code execution
- Web shell replaces locale.php and swaps client installers with infected versions
- PhantomGraph backdoor uses two DLLs with OneDrive as C2, installed as services
- Attackers also run SSH reverse tunnels and dump lsass.exe memory
- Kaspersky separately disclosed HelloNet attacks hijacking ViPNet updates
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1105 Ingress Tool TransferT1543.003 Windows ServiceT1003.001 LSASS Memory
- Organizations
- KasperskyPositive TechnologiesCheck Point
- Countries
- RussiaSoutheast Asia
From the original article
5 min read at thehackernews.com
The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning instrumentation, electronics, transport, energy, IT, and software development sectors. Russian cybersecurity vendor Kaspersky said it detected the attacks in July 2026.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.