Kaspersky Reports Head Mare Exploiting TrueConf Server to Deploy PhantomCore and PhantomGraph

Aug 11, 2026 · Original article ↗

Summary

Kaspersky reports Head Mare exploited two TrueConf Server flaws for SYSTEM-level access, planted a web shell and replaced client installers with PhantomCore; it also deployed PhantomGraph. Targets included Russian organizations; patches were released June 18, 2026.

Key points

Kaspersky says the July 2026 campaign targeted Russian organizations in manufacturing, electronics, transport, energy, IT and software.
Attackers reportedly reached TrueConf servers over TCP port 4307 and chained flaws KLCERT-26-057 and KLCERT-26-058 to escape isolation and execute code as SYSTEM.
After gaining elevated access, they replaced a TrueConf server file with a web shell used to gather infrastructure data, access the TrueConf database and substitute infected client installers.
The infected installers delivered PhantomCore; web-shell access also deployed PhantomGraph. Its SysExcSvc module used Microsoft OneDrive for command and control, while SysReadSvc ran commands.
Reported persistence methods included a registry entry and Windows services. Kaspersky identified activity involving LSASS memory dumping and an SSH reverse tunnel.
Kaspersky says vendor updates for versions 5.3.9, 5.4.9 and 5.5.5 were released June 18, 2026. It recommends updating and checking that client installers have valid digital signatures, including installers obtained through business partners.
Kaspersky provides detection rules and hunting guidance for suspicious TrueConf file creation, unsigned installers, service and registry activity, and LSASS access.

Article Details

Attack Vectors: Attackers connected to TrueConf Server over TCP port 4307 without prior authorization and exploited vulnerabilities KLCERT-26-057 and KLCERT-26-058 to execute code with NT AUTHORITY\SYSTEM privileges.
A web shell was installed by replacing the TrueConf Server file locale.php. Attackers used it for infrastructure reconnaissance, privileged database access, and replacement of legitimate TrueConf Client distributions with infected installers.
The infected TrueConf Client installers delivered PhantomCore. Web-shell access was also used to deploy PhantomGraph, whose SysExcSvc.dll component used Microsoft OneDrive as a command-and-control channel.
PhantomGraph persistence was established by installing SysExcSvc.dll and SysReadSvc.dll as Windows services; PhantomCore persistence also used a registry entry.
Observed activity included LSASS reconnaissance and memory dumping, user and system name discovery, and launching an SSH reverse tunnel. Kaspersky also reports that Head Mare distributes backdoors through phishing, exploitation of public web servers, or subcontractors.
Defensive Notes: Install the latest TrueConf Server updates; the article identifies versions 5.3.9, 5.4.9, and 5.5.5 as patched updates released on June 18, 2026.
Verify that TrueConf Client distributions obtained from organizational or partner servers have a valid TrueConf digital signature and have not been tampered with.
Monitor for suspicious files created by TrueConf Server processes, unsigned TrueConf installers, suspicious process chains from TrueConf update executables, and unexpected libraries registered under the reported SoftwareClasses\CLSID registry key.
Monitor for creation of SysExcSvc and SysReadSvc, suspicious access to or memory dumps of lsass.exe, and SSH-created tunnels. Ensure Windows Security events 4688, 4663, 4657, and 4697 and Sysmon events 1, 7, 11, and 13 are collected.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bright-deals[.]site`	Listed in the campaign's domain indicators; its specific function is not stated.
DOMAIN	`cosmetic-deals[.]store`	Listed in the campaign's domain indicators; its specific function is not stated.
DOMAIN	`flexish[.]shop`	Listed in the campaign's domain indicators; its specific function is not stated.
DOMAIN	`media-hub[.]today`	Listed in the campaign's domain indicators; its specific function is not stated.
DOMAIN	`nova-stream[.]site`	Listed in the campaign's domain indicators; its specific function is not stated.
DOMAIN	`penzadogshelter[.]site`	Listed by the source as a domain associated with attacker infrastructure.
DOMAIN	`rinomobile[.]ink`	Listed in the campaign's domain indicators; its specific function is not stated.
DOMAIN	`trendy-market[.]site`	Listed by the source as a domain associated with attacker infrastructure.
DOMAIN	`urbanpixel[.]store`	Listed in the campaign's domain indicators; its specific function is not stated.
DOMAIN	`vks[.]gossopka[.]forum`	Listed by the source as a domain associated with attacker infrastructure.
IPV4	`194[.]87[.]93[.]153`	Listed as an attack-related IP indicator; the source associates it with SSH activity.
IPV4	`31[.]59[.]102[.]61`	Listed in the campaign's IP indicators; its specific function is not stated.
IPV4	`38[.]244[.]205[.]244`	Listed in the campaign's IP indicators; its specific function is not stated.
MD5	`0e4541c3153ec5ed01497f19cf4f63d0`	MD5 hash listed for a PhantomGraph SysExcSvc component.
MD5	`0e79996d9483d1e44fea32b0a48c2c19`	MD5 hash listed for a PhantomCore-associated file.
MD5	`12d4e8f5295f2ef7e0f9bfc0f4830939`	MD5 hash listed for a PhantomGraph SysExcSvc component.
MD5	`2bb75c20e778eb5c416965bd4d4259b1`	MD5 hash identified for an infected TrueConf Client installer.
MD5	`43f435c3c437bc879a2d7d4634f43494`	MD5 hash listed for an ELF backdoor associated with the campaign.
MD5	`489f43be558b2679284ceabed7adc4f3`	MD5 hash identified for the PhantomGraph SysExcSvc component.
MD5	`4d27b4eb1c5dbb3d8160f29b8119523e`	MD5 hash identified for the Head Mare web shell.
MD5	`748c9f8cb1065000616204935f96207f`	MD5 hash identified for the infected TrueConf Client installer.
MD5	`8fcc3e4ccbf1725d9989fb464abf3561`	MD5 hash listed for a PhantomCore-associated file.
MD5	`aee9642b45b099cb7f3053b9b680b425`	MD5 hash identified for a rootkit installed on TrueConf servers.
MD5	`b348642146ea34771e5785c5857950f5`	MD5 hash listed for a PhantomCore-associated file.
MD5	`b3a6fee3307f1c26841fd5c603e2b013`	MD5 hash listed for a PhantomCore-associated file.
MD5	`c3a2abe8756910f42582b04a44ea3514`	MD5 hash listed for an ELF backdoor associated with the campaign.
MD5	`c915cb6c2aeb863ee8479238e1644217`	MD5 hash listed for a PhantomCore-associated file.
MD5	`dd1fd2b459b97b7d59375cb8383cd19a`	MD5 hash identified for the PhantomGraph SysReadSvc component.
MD5	`ec0bf4a2186a88874e9f26f07cfeb532`	MD5 hash listed for a PhantomCore-associated file.
SHA256	`c5a460e4e68a088f6e51b2c6474642ec129462164a7d52e9ea8560b60f0412c5`	SHA-256 hash identified for a PhantomCore component.