Head Mare Compromises TrueConf Servers and Distributes Clients with PhantomCore

Attacks Targeting Unpatched TrueConf Servers

The hacktivist group Head Mare is exploiting vulnerable TrueConf servers to tamper with official client installers and distribute malware. Kaspersky identified the attacks in July, and the campaign was publicly disclosed on August 8, 2026.

The target is TrueConf Server, an on-premises video conferencing platform used primarily in Russia by businesses and government organizations. The observed operations affected organizations in the instrumentation, electronics, transportation, energy, IT, and software development sectors.

Initial access is obtained through TCP port 4307, which is exposed by default and reachable without authentication. The attacker uses KLCERT-26-057 to execute scripts within TrueConf’s isolated environment and KLCERT-26-058 to escape the sandbox and reach the underlying operating system.

After obtaining NT AUTHORITY\SYSTEM privileges, the attacker replaces \public\js\locale.php with a persistent web shell. This component can collect information about the environment, query the TrueConf database, and modify packages distributed to users.

Vulnerable Versions and Trojanized Installers

The following versions are affected:

• 5.3.x versions earlier than 5.3.9;
• 5.4.x versions earlier than 5.4.9;
• 5.5.x versions earlier than 5.5.5;
• older releases.

Fixes are available in versions 5.3.9, 5.4.9, and 5.5.5, released on June 18. Server administrators must therefore update according to the installed branch rather than simply replacing the client on individual computers.

The web shell replaces the official TrueConf client installer. When a user connected to the local server receives an update, they may download an unsigned program containing PhantomCore, a backdoor embedded in the tampered package.

Organizations that do not directly manage a TrueConf infrastructure may also be affected. The risk extends to connections to compromised servers operated by partners, suppliers, or other third parties.

PhantomCore and PhantomGraph

PhantomCore provides the attacker with a backdoor on systems that install the manipulated client. The compromise can therefore spread from the video conferencing platform to users’ workstations.

PhantomGraph has also been observed, consisting of the SysExcSvc.dll and SysReadSvc.dll DLLs. The malware receives commands through a Microsoft OneDrive account, executes them, and sends the results back.

Observed activities include:

• system reconnaissance using commands such as hostname and whoami;
• dumping LSASS process memory to steal credentials;
• remotely executing commands;
• creating a reverse SSH tunnel.

The result is extensive control over the host, enabling lateral movement, credential harvesting, and persistent remote access.

Links to Previous Campaigns and Countermeasures

In April 2026, Check Point Research reported the exploitation of CVE-2026-3502, a zero-day vulnerability allowing arbitrary file execution through trojanized TrueConf client updates. The campaign was named Operation True Chaos and tentatively attributed to Chinese actors associated with the Havoc framework.

To check for a potential compromise, administrators should:

1. update TrueConf Server to at least version 5.3.9, 5.4.9, or 5.5.5;
2. verify the digital signature of TrueConf installers received by users;
3. examine the \public\js\locale.php file;
4. investigate anomalous access to TCP port 4307;
5. search for the SysExcSvc.dll and SysReadSvc.dll DLLs;
6. check for unusual activity involving OneDrive, LSASS, and SSH tunnels.

Organizations should extend these checks to servers managed by partners and suppliers. The exact versions installed on compromised systems and the full scope of the impact remain unknown.