cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Kaspersky Finds Head Mare Exploiting TrueConf Flaws to Trojanize Installers

· Original article ↗

Summary

Kaspersky says Head Mare exploited TrueConf Server flaws to replace client installers with PhantomCore backdoors and deploy PhantomGraph for command execution and credential theft. TrueConf patched affected versions in updates released June 18.

Key points

  • Kaspersky reported that Head Mare exploited TrueConf Server vulnerabilities to execute code and escape the server's isolated environment.
  • The attackers connected to target servers over TCP port 4307, which the article says is open by default, and replaced a server file with a web shell for persistent access.
  • The web shell was used to collect information, access the TrueConf database, and replace legitimate client installers with unsigned versions containing PhantomCore.
  • PhantomGraph used a Microsoft OneDrive account to receive commands and return results; observed activity included dumping LSASS memory to steal credentials.
  • Kaspersky reported additional reconnaissance commands and use of a reverse SSH tunnel.
  • The reported campaign targeted Russian organizations in several sectors; Kaspersky cited phishing, exploitation of public-facing web servers, and contractor access as initial-access methods.
  • TrueConf fixed the flaws in Server versions 5.3.9, 5.4.9, and 5.5.5, released June 18.

Article Details

Attack Vectors
  • Head Mare reportedly connected to unpatched TrueConf servers over TCP port 4307, which the article says is open by default, without authentication.
  • The attackers exploited TrueConf vulnerabilities to execute a malicious script in TrueConf’s isolated environment, escape the sandbox, and run commands on the underlying operating system.
  • After gaining NT AUTHORITY SYSTEM privileges, the attackers replaced publicjslocale.php with a web shell and used it to access sensitive information and the TrueConf database.
  • The attackers replaced legitimate TrueConf Client installers hosted on compromised servers with unsigned installers carrying PhantomCore; users could receive them when connecting to affected servers.
  • PhantomGraph used a Microsoft OneDrive account to receive commands and return results. Reported activity included dumping LSASS memory, running reconnaissance commands such as hostname and whoami, and starting a reverse SSH tunnel.
  • Kaspersky said the campaigns also used phishing, exploitation of public-facing web servers, and access through contractors for initial access.
Defensive Notes
  • Update TrueConf Server to version 5.3.9, 5.4.9, or 5.5.5, as applicable; the article says these versions fixed the vulnerabilities and were released on June 18.
  • Treat TrueConf Client installers obtained from potentially compromised counterparty servers with caution; Kaspersky warned that users could download infected packages even if their own organization did not use TrueConf Server.

MITRE ATT&CK

T1003.001 · LSASS MemoryPhantomGraph was used to dump memory from the LSASS process to obtain credentials.T1059 · Command and Scripting InterpreterThe attackers executed a malicious script and ran operating-system commands, including hostname and whoami.T1068 · Exploitation for Privilege EscalationThe attackers reportedly raised their privileges to NT AUTHORITY SYSTEM.T1102.002 · Bidirectional CommunicationPhantomGraph accepted commands through a Microsoft OneDrive account and returned results through that service.T1190 · Exploit Public-Facing ApplicationHead Mare reportedly exploited vulnerabilities in exposed TrueConf servers to gain access.T1195.002 · Compromise Software Supply ChainThe attackers replaced legitimate TrueConf Client installers on compromised TrueConf servers with trojanized installers carrying PhantomCore.T1505.003 · Web ShellThe attackers replaced publicjslocale.php with a web shell that provided persistent remote access.T1566 · PhishingKaspersky listed phishing among the initial access methods used in the campaigns.T1572 · Protocol TunnelingThe reported PhantomGraph activity included starting a reverse SSH tunnel.

CVE

CVE-2026-3502In April 2026, CheckPoint Research reported that hackers were targeting a zero-day arbitrary file execution flaw in TrueConf, tracked as CVE-2026-3502, compromising users via trojanized client updates.

Threat Actors

Head MareKaspersky attributed exploitation of unpatched TrueConf servers, web-shell deployment, and trojanized client installers delivering PhantomCore and PhantomGraph to Head Mare.

Malware

HavocCheckPoint named the campaign ‘Operation True Chaos,’ and tentatively attributed it to Chinese threat actors behind the Havoc implant, which was used in these attacks.PhantomCoreHead Mare has been exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with trojanized versions that deliver the PhantomCore and PhantomGraph backdoors.PhantomGraphHead Mare has been exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with trojanized versions that deliver the PhantomCore and PhantomGraph backdoors.

Vendors

MicrosoftTrueConf is a video conferencing tool widely used in Russia, especially in the enterprise and government sectors, as a secure, on-premise alternative to Western tools such as Zoom and Microsoft Teams.TrueConfHead Mare has been exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with trojanized versions that deliver the PhantomCore and PhantomGraph backdoors.

Products

Microsoft OneDrivePhantomGraph used OneDrive for command control and credential theft.TrueConf Clientinformation from the victim’s environment, access the TrueConf database, and replace the legitimate TrueConf Client installer hosted on the server with a malicious version that contains the PhantomCore backdoor.TrueConf ServerHead Mare has been exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with trojanized versions that deliver the PhantomCore and PhantomGraph backdoors.

Countries

RussiaTrueConf is a video conferencing tool widely used in Russia, especially in the enterprise and government sectors, as a secure, on-premise alternative to Western tools such as Zoom and Microsoft Teams.

Industries

ElectronicsKaspersky says it is currently observing multiple active Head Mare campaigns targeting Russian organizations in various sectors: instrumentation, electronics, transportation, energy, IT, and software development.EnergyKaspersky says it is currently observing multiple active Head Mare campaigns targeting Russian organizations in various sectors: instrumentation, electronics, transportation, energy, IT, and software development.instrumentationKaspersky says it is currently observing multiple active Head Mare campaigns targeting Russian organizations in various sectors: instrumentation, electronics, transportation, energy, IT, and software development.ITKaspersky says it is currently observing multiple active Head Mare campaigns targeting Russian organizations in various sectors: instrumentation, electronics, transportation, energy, IT, and software development.Software developmentKaspersky says it is currently observing multiple active Head Mare campaigns targeting Russian organizations in various sectors: instrumentation, electronics, transportation, energy, IT, and software development.TransportationKaspersky says it is currently observing multiple active Head Mare campaigns targeting Russian organizations in various sectors: instrumentation, electronics, transportation, energy, IT, and software development.

Related Articles