In July 2026, the cyber threat group known as Head Mare launched attacks against Russian companies in sectors such as instrumentation, electronics, transport, energy, IT, and software development. These attacks exploited vulnerabilities in unpatched TrueConf video conferencing servers to deploy the PhantomCore backdoor and remote access trojan (RAT).
The vulnerabilities, identified as KLCERT-26-057 and KLCERT-26-058, allow attackers to execute arbitrary code with elevated privileges. Affected versions include TrueConf Server 5.3.x up to 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and earlier releases.
Attack Methodology
The attack sequence involves several steps:
- Attackers connect to the TrueConf server via TCP port 4307, which is open by default.
- They exploit KLCERT-26-057 to execute a malicious script within an isolated environment on the server.
- Using KLCERT-26-058, they escape the isolated environment to run commands on the host system with NT AUTHORITY\SYSTEM privileges.
- The attackers replace the file “…\public\js\locale.php” with a web shell to maintain persistent remote access.
This web shell enables the attackers to gather information about the IT infrastructure, gain privileged access to the TrueConf database, and replace the original TrueConf Client installer with a compromised version containing the PhantomCore backdoor.
PhantomGraph Backdoor
Additionally, the attackers deploy another backdoor named PhantomGraph, which consists of two DLL modules:
- “SysExcSvc.dll” receives commands and sends results to a Microsoft OneDrive account used as a command-and-control (C2) server.
- “SysReadSvc.dll” parses and executes the received commands, storing the results.
To establish persistence, the attackers execute a Base64-encoded PowerShell command that installs these DLLs as Windows services. This modular approach likely aims to evade detection by endpoint detection and response (EDR) tools.
Additional Malicious Activities
The threat actors also initiate an SSH reverse tunnel, create a memory dump of the “lsass.exe” process, and collect system information using commands like “hostname” and “whoami.”
Mitigation and Recommendations
TrueConf has addressed these vulnerabilities in Server versions 5.3.9, 5.4.9, and 5.5.5, released on June 18, 2026. Organizations using TrueConf are strongly advised to update to the latest versions to mitigate these security risks.
Notably, this is not the first instance of Head Mare exploiting TrueConf vulnerabilities. In April 2026, the group leveraged three other vulnerabilities (BDU:2025-10114, BDU:2025-10115, and BDU-2025-10116) to deliver PHP web shells and malicious payloads for information theft and command execution. Around the same time, another high-severity flaw in the TrueConf client (CVE-2026-3502) was exploited in attacks targeting Southeast Asian government entities to deploy the Havoc C2 framework.
These incidents underscore the critical importance of timely software updates and robust security practices. Organizations should prioritize patch management and monitor their systems for signs of compromise to defend against such sophisticated cyber threats.
