Hackers Exploit TrueConf Vulnerabilities to Deploy Backdoor Malware

Introduction

In a significant breach affecting the TrueConf video conferencing platform, hackers from the Head Mare hacktivist group exploited unpatched vulnerabilities to deliver malware-laden client installers. This attack compromises users by injecting backdoors that allow for extensive unauthorized access and control over affected systems.

The Attack Unveiled

Researchers at Kaspersky, a prominent cybersecurity firm, identified the breach in July 2026. They uncovered that the Head Mare group had been leveraging two critical vulnerabilities to execute arbitrary code on TrueConf servers, thereby facilitating the delivery of malware:

• KLCERT-26-057 — This vulnerability allowed attackers to run scripts in TrueConf's isolated environment without proper authentication.
• KLCERT-26-058 — This flaw enabled attackers to escape the sandbox environment, granting them elevated privileges on the operating system.

Once inside, attackers escalated their privileges to NT AUTHORITY\SYSTEM and deployed a web shell, providing persistent access to the compromised servers. The presence of this backdoor not only allows for data theft but also enables subsequent updates of legitimate software installers with malicious alternatives.

Tactics and Tools Used in the Breach

The Head Mare hackers utilized TCP port 4307, which is typically unsecured and open by default, to access the TrueConf servers without any authentication procedures. The malicious script replaced the original installer for the TrueConf Client with an infected version containing the PhantomCore backdoor.

Even organizations that do not directly use TrueConf servers face risks as their employees might connect to affected servers to join virtual meetings and inadvertently download the compromised client installer.

PhantomCore and PhantomGraph Backdoors

The attack employed two specific backdoor variants:

• PhantomCore — This is a backdoor that allows the attacker to execute commands remotely on compromised devices.
• PhantomGraph — This variant consists of two DLL files, SysExcSvc.dll and SysReadSvc.dll, which accept commands transmitted through a Microsoft OneDrive account, executing them and returning results back to the attacker.

Reported activities using PhantomGraph included dumping the memory of critical processes—specifically the Local Security Authority Subsystem Service (LSASS)—to extract sensitive credentials and perform reconnaissance, such as gathering hostnames and user identity details.

Target Landscape

Kaspersky noted that Head Mare is currently running multiple campaigns targeting various industries in Russia, including:

• Instrumentation
• Electronics
• Transportation
• Energy
• Information Technology
• Software Development

The hackers are employing a multitude of initial access strategies, including phishing, exploiting vulnerabilities in public-facing web servers, and leveraging access through contractor systems to gain footholds within organizations.

Vulnerabilities in TrueConf

The flaws exploited in this attack affect several TrueConf Server versions, specifically:

• 5.3.x before 5.3.9
• 5.4.x before 5.4.9
• 5.5.x before 5.5.5

These vulnerabilities have since been patched in updates released on June 18, 2026. However, the delay in applying these critical updates left many systems exposed to exploitation.

Operation True Chaos

Security research from CheckPoint in April 2026 had already indicated the presence of ongoing attacks exploiting a zero-day flaw in TrueConf, tracked as CVE-2026-3502. This earlier campaign, dubbed Operation True Chaos, is believed to be orchestrated by Chinese threat actors linked to a capability called the Havoc implant. This highlights the ongoing threat to organizations relying on TrueConf, even beyond the current Head Mare campaigns.

Preventing Future Attacks

Organizations are advised to implement rigorous security measures, including regularly updating software to the latest versions and monitoring network traffic for unusual activity. Security teams have found that a significant portion of successful attacks go unnoticed, indicating a need for improved detection capabilities and incident response procedures. A recent statistic shows that security teams log only 54% of successful attacks, while alerts are raised on just 14% of those, emphasizing a gap in current defensive strategies.

Key Takeaways

• The Head Mare group exploited vulnerabilities in TrueConf, replacing client installers with malicious versions.
• Attacks leverage unpatched vulnerabilities enabling unauthorized access and privilege escalation.
• PhantomCore and PhantomGraph backdoors facilitate extensive control and data exfiltration.
• Organizations should prioritize software updates and enhance their security monitoring frameworks.

Conclusion

The breach of TrueConf is a stark reminder of the vulnerabilities present in widely used software solutions, particularly in environments where secure communication tools are critical. The exploitation of these vulnerabilities by the Head Mare hackers not only affects the direct users of TrueConf but also presents significant risks to organizations that interact with compromised systems. Proactive security measures and a commitment to updating software are essential to defend against these evolving threats.