Check Point Says TrueConf Zero-Day Was Used in Asian Government Attacks
Summary
Check Point says attackers exploited CVE-2026-3502 by replacing updates on a compromised on-premises TrueConf server, distributing malware to government clients in Asia. TrueConf fixed the flaw in client 8.5.3.
Key points
- CVE-2026-3502, rated CVSS 7.8, affects TrueConf client updates that lack integrity and authenticity checks before the installer runs.
- Check Point says attackers compromised a government-operated on-premises TrueConf server and replaced its update package; dozens of government entities received the malicious update.
- Attackers likely sent a link prompting targets to launch the client and trigger the update process.
- The modified package dropped a malicious library and a legitimate executable abused for DLL sideloading; the implant supported reconnaissance, persistence, preparation for lateral movement and fetching additional payloads.
- Check Point did not observe retrieval of the final payload, but observed network communication with an IP used as command-and-control infrastructure for Havoc.
- Check Point believes a Chinese threat actor was responsible; the article does not report independent confirmation of that attribution.
- TrueConf fixed the flaw in client version 8.5.3, released in March. CISA added it to the KEV catalog and urged federal agencies to patch by April 16.
Article Details
- Vulnerability Types
- Improper verification of software updates
- Code execution through a malicious update
- Severity
- CVSS 7.8
- Affected Versions
- TrueConf client versions before 8.5.3
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1105 · Ingress Tool TransferThe implant was capable of fetching additional payloads, although Check Point did not observe it retrieve the final payload.T1195.002 · Compromise Software Supply ChainAttackers compromised an on-premises TrueConf server and replaced its update package with a malicious one distributed to client endpoints.T1574.002 · DLL Side-LoadingA legitimate executable was abused for DLL sideloading to execute a malicious library dropped by the modified update.