cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

TrueConf Zero-Day Exploited to Push Malicious Updates to Connected Clients

· Original article ↗

Summary

Check Point says the TrueChaos campaign exploited CVE-2026-3502 to push malicious updates from compromised on-premises TrueConf servers. Versions 8.1.0–8.5.2 are affected; version 8.5.3 includes a fix.

Key points

  • CVE-2026-3502 stems from a missing integrity check that allowed attackers controlling an on-premises TrueConf server to replace update packages with arbitrary executables.
  • Check Point says the TrueChaos campaign used compromised servers to distribute fake updates to connected clients, targeting government entities in Southeast Asia.
  • TrueConf versions 8.1.0 through 8.5.2 are affected; the vendor released a fix in version 8.5.3 in March 2026.
  • The reported infection chain included DLL sideloading, reconnaissance, a UAC bypass, privilege escalation, and persistence.
  • Check Point has moderate confidence in linking the activity to a Chinese-nexus actor; network traffic suggested likely use of Havoc C2, but researchers did not recover the final payload.
  • The article lists poweriso.exe, 7z-x64.dll, %AppData%RoamingAdobeupdate.7z, and iscsiexe.dll as indicators or suspicious artifacts.

Article Details

Vulnerability Types
  • Missing integrity check in the software update mechanism
Severity
Medium
Affected Versions
  • TrueConf 8.1.0–8.5.2
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1057 · Process DiscoveryThe attackers used tasklist as a reconnaissance tool.T1072 · Software Deployment ToolsAttackers used the TrueConf update mechanism on a centrally managed server to distribute malicious executables to connected clients.T1548.002 · Bypass User Account ControlThe infection chain reportedly used iscicpl.exe for a UAC bypass.T1574.001 · DLLThe reported infection chain included DLL sideloading, with 7z-x64.dll and iscsiexe.dll noted as suspicious artifacts.

CVE

CVE-2026-3502Trueconf · TrueconfAttackers exploited a zero-day in TrueConf’s update mechanism (CVE-2026-3502) to replace legitimate updates with malicious executables and distribute them to all connected endpoints.

Threat Actors

Amaranth DragonThe article says this Chinese threat cluster previously used Havoc in attacks with a similar targeting scope; it does not attribute the TrueChaos activity to the cluster.

Products

TrueConfAttackers exploited a zero-day in TrueConf’s update mechanism (CVE-2026-3502) to replace legitimate updates with malicious executables and distribute them to all connected endpoints.

Tools

Havocto Chinese-nexus activity and observed DLL sideloading, UAC bypass, reconnaissance, and likely use of the Havoc C2; TrueConf versions 8.1.0–8.5.2 were patched in 8.5.3 (March 2026).

Industries

Critical infrastructureKey IoCs include poweriso.exe, 7z-x64.dll, %AppData%RoamingAdobeupdate.7z, and iscsiexe.dll, with victims including government and critical infrastructure organizations.GovernmentKey IoCs include poweriso.exe, 7z-x64.dll, %AppData%RoamingAdobeupdate.7z, and iscsiexe.dll, with victims including government and critical infrastructure organizations.

Related Articles