Head Mare Breached TrueConf Servers and Swapped Client Installers for Backdoored Ones

In July, researchers at Kaspersky uncovered an attack in which the Head Mare group compromised TrueConf videoconferencing servers. The product is widely used in Russia, primarily in the corporate and government sectors, as a secure on-premises alternative to the Western Zoom and Microsoft Teams.

How the attack works

The attackers connected to the server through TCP port 4307, which is open by default and requires no authentication. They then exploited two vulnerabilities that Kaspersky tracks internally as KLCERT-26-057 and KLCERT-26-058: the first allowed a malicious script to run inside TrueConf's isolated environment, while the second let them break out of the sandbox and execute commands on the host operating system.

After escalating privileges to NT AUTHORITY\SYSTEM, the attackers replaced the \public\js\locale.php file with a web shell that provided persistent remote access. Through it they gathered data about the victim's environment, gained access to the TrueConf database, and swapped the legitimate client installer for a malicious version bundled with the PhantomCore backdoor.

A danger to third-party organizations

When an organization's employees connected to the local TrueConf server, they received the trojanized, unsigned installer disguised as an update. And the risk, Kaspersky warns, extends beyond the server's owners: even if a company doesn't use TrueConf itself, its employees may connect to compromised servers belonging to business partners for online meetings and download the infected packages.

Separately, Head Mare deploys a second backdoor — PhantomGraph. It consists of two DLLs (SysExcSvc.dll and SysReadSvc.dll), receives commands through a Microsoft OneDrive account, and returns the results. Among the observed actions were dumping the memory of the LSASS process to steal credentials, reconnaissance commands such as hostname and whoami, and launching a reverse SSH tunnel.

Scale and defense

According to the researchers, several Head Mare campaigns against Russian organizations are currently active at once, spanning instrument engineering, electronics, transport, energy, IT, and software development. For initial access, the group uses phishing, exploitation of publicly accessible web servers, and intrusion through contractors.

The vulnerabilities affect TrueConf Server versions 5.3.x up to 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and earlier. The vendor fixed them in the 5.3.9, 5.4.9, and 5.5.5 releases issued on June 18.

It's worth noting that TrueConf has drawn attackers' attention before: in April 2026, Check Point Research reported on Operation True Chaos, a campaign that exploited the zero-day vulnerability CVE-2026-3502 and infected users through trojanized client updates. That attack was tentatively linked to Chinese groups behind the Havoc implant.

Source: Bleeping Computer