TrueConf Zero-Day Exploited in Southeast Asian Government Campaign
Summary
Check Point Research reports CVE-2026-3502 was exploited through TrueConf’s on-premises update flow against Southeast Asian government entities, with the missing final payload assessed as likely Havoc. TrueConf fixed the flaw in Windows client 8.5.3.
Key points
- CVE-2026-3502 affects TrueConf client update validation: an attacker controlling an on-premises TrueConf server could replace an update and distribute arbitrary files to connected clients.
- Check Point Research observed the flaw exploited in the TrueChaos campaign targeting government entities in Southeast Asia.
- The malicious update dropped a benign poweriso.exe and malicious 7z-x64.dll; the report describes DLL side-loading and follow-on activity including reconnaissance, additional tool downloads, and persistence.
- The attackers modified the user PATH and abused the auto-elevated iscsicpl.exe binary for DLL search-order hijacking and UAC bypass.
- Check Point observed communications with Havoc C2 infrastructure and assesses with high confidence that the missing final payload was a Havoc implant.
- Check Point assesses with moderate confidence that the activity is associated with a Chinese-nexus actor; it also observed the same victim targeted by ShadowPad during the same period.
- TrueConf’s fix is included in Windows client version 8.5.3, released in March 2026; the report lists version 8.5.2 as the current desktop-app version at the time.
Article Details
- Attack Vectors
- The attacker replaced the update package on a compromised on-premises TrueConf server, using the trusted update mechanism to distribute and execute a malicious client update to connected government endpoints.
- The weaponized update dropped 7z-x64.dll, which was loaded through DLL side-loading alongside poweriso.exe.
- The attacker modified the current user's PATH and abused the auto-elevated iscsicpl.exe to load iscsiexe.dll and bypass UAC.
- The attacker retrieved additional components from an FTP server and established persistence with an HKCU Run entry.
- Defensive Notes
- Update the TrueConf Windows client to version 8.5.3 or later; the article says the fix is included beginning with version 8.5.3.
- Investigate unsigned trueconf_windows_update.exe files and unexpected C:\ProgramData\PowerISO\poweriso.exe files.
- Check for the HKCU Run value UpdateCheck pointing to C:\ProgramData\PowerISO\PowerISO.exe.
- Look for update.7z, 7za.exe, iscsiexe.dll, and rom.dat in the locations described in the article, and investigate suspicious creation or deletion activity.
- Hunt for the process chain trueconf.exe -> trueconf_windows_update.exe -> trueconf_windows_update.tmp and for poweriso.exe spawning cmd.exe with download, extraction, or discovery utilities.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 43[.]134[.]52[.]221 | Havoc C2 server identified by the article. |
| IPV4 | 43[.]134[.]90[.]60 | Havoc C2 server identified by the article. |
| IPV4 | 47[.]237[.]15[.]197 | Attacker-controlled server observed hosting Havoc C2 and used as an FTP host for additional components. |
| MD5 | 22e32bcf113326e366ac480b077067cf | Hash identified for the malicious TrueConf client update. |
| MD5 | 248a4d7d4c48478dcbeade8f7dba80b3 | Hash identified for the malicious 7z-x64.dll implant. |
| MD5 | 9b435ad985b733b64a6d5f39080f4ae0 | Hash identified for the iscsiexe.dll loader used in the attack. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe attacker ran tracert 8.8.8.8 -h 5 during reconnaissance.T1057 · Process DiscoveryThe attacker enumerated running processes with tasklist.T1071 · Application Layer ProtocolThe article reports network communication from compromised hosts to Havoc C2 infrastructure, including 47.237.15[.]197.T1105 · Ingress Tool TransferThe attacker used curl or FTP to retrieve update.7z and additional components from the attacker-controlled server.T1195 · Supply Chain CompromiseThe attacker abused the compromised on-premises TrueConf server's update channel to distribute a malicious update to connected clients.T1547.001 · Registry Run Keys / Startup FolderPersistence was established through an HKCU Run value named UpdateCheck pointing to PowerISO.exe.T1548 · Abuse Elevation Control MechanismThe attacker abused the auto-elevated iscsicpl.exe and a user-controlled DLL to bypass UAC and escalate privileges.T1574.001 · DLLThe malicious update placed 7z-x64.dll alongside poweriso.exe, and the DLL was loaded through side-loading.T1574.002 · DLL Side-LoadingThe attacker modified the user's PATH so iscsicpl.exe could resolve and load the attacker-provided iscsiexe.dll.