Head Mare Breaches TrueConf Servers to Trojanize Client Installers with PhantomCore/PhantomGraph Backdoors

Head Mare Breaches TrueConf Servers to Trojanize Client (TL-2026-1945) is a high-severity supply-chain compromise, first published 2026-08-08. It is attributed to Head Mare with high confidence, affects TrueConf TrueConf Server, maps to 10 MITRE ATT&CK techniques (T1003.001, T1033, T1036.005), and is covered by 9 detection rules and 10 indicators of compromise.

Key facts for TL-2026-1945

Threat ID
TL-2026-1945
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-08-08
Last reviewed
2026-08-08
Attribution
Head Mare
Attribution confidence
HIGH
Motivation
HACKTIVISM
Target sectors
instrumentation, electronics, transport, energy, information technology, software development
Target regions
russia
Detection rules
9
Indicators of compromise
10

Malware and tooling in Head Mare Breaches TrueConf Servers to Trojanize Client

Malware and tooling: PhantomCore, PhantomGraph, Custom PHP web shell (locale.php replacement), Microsoft OneDrive

The Head Mare hacktivist group exploited two unpatched vulnerabilities (KLCERT-26-057, KLCERT-26-058) in TrueConf video conferencing servers over unauthenticated TCP/4307 to plant a web shell, escalate to NT AUTHORITY\SYSTEM, and trojanize the legitimate TrueConf Client installer with the PhantomCore backdoor. A second backdoor, PhantomGraph (SysExcSvc.dll/SysReadSvc.dll), was deployed on victim hosts and receives commands via a Microsoft OneDrive account. Kaspersky discovered the campaign in July 2026, targeting Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development.

How Head Mare Breaches TrueConf Servers to Trojanize Client works

Head Mare, a pro-Ukraine hacktivist collective that has targeted Russian and Belarusian organizations since 2023, compromised on-premise TrueConf video conferencing servers to run a supply-chain attack against everyone who connects to them. The group reached TrueConf's management interface over TCP/4307, a port that is open by default and requires no authentication. Two chained flaws tracked internally by Kaspersky as KLCERT-26-057 (arbitrary script execution inside TrueConf's isolated/sandboxed execution environment) and KLCERT-26-058 (sandbox escape enabling OS-level command execution) let the attackers execute commands as NT AUTHORITY\SYSTEM on the underlying Windows host.

With SYSTEM-level access, Head Mare replaced the legitimate server file public/js/locale.php with a web shell, giving them persistent remote access. That access was used to reach the TrueConf server's database and to harvest sensitive environment information. Critically, the attackers used the database access to swap the legitimate, digitally-signed TrueConf Client installer hosted on the server for an unsigned, trojanized build carrying the PhantomCore backdoor. Because organizations' own employees fetch the client installer directly from their internal TrueConf server when joining a call, this converts a single compromised server into a distribution point that silently backdoors every subsequent connecting user — a supply-chain compromise rather than a one-off intrusion.

A second, functionally separate backdoor — PhantomGraph, implemented as two DLLs named SysExcSvc.dll and SysReadSvc.dll — was also observed on affected hosts. PhantomGraph receives commands via a Microsoft OneDrive account (blending its C2 traffic with legitimate cloud storage activity) and returns execution results over the same channel. Observed operator activity through PhantomGraph includes dumping LSASS process memory for credential theft, basic host reconnaissance (hostname, whoami), and establishing reverse SSH tunnels back to attacker-controlled infrastructure.

TrueConf fixed the exploited vulnerabilities on 2026-06-18 in Server versions 5.3.9, 5.4.9, and 5.5.5; any instance still on an earlier 5.3.x, 5.4.x, or 5.5.x build remains exposed. Kaspersky states it is tracking multiple active Head Mare campaigns against Russian organizations concurrently.

This is one of several distinct campaigns in which Head Mare has abused TrueConf as a supply-chain vector — an earlier campaign (approximately September 2025–February 2026) exploited a different set of vulnerabilities (BDU:2025-10114/10115/10116, patched August 2025) to deploy a different backdoor (PhantomPxPigeon); those are documented separately and are NOT part of this record. Likewise, a separate April 2026 campaign referencing CVE-2026-3502 ("Operation True Chaos") used a similar trojanized-update delivery mechanism but is tentatively attributed to a distinct, Havoc-implant-linked Chinese actor and is unrelated to Head Mare's July 2026 PhantomCore/PhantomGraph activity documented here.

MITRE ATT&CK techniques used in TL-2026-1945

Credential Access

T1003.001 LSASS Memory

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.003 Windows Command Shell

Command and Control

T1102.002 Bidirectional Communication; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain

Persistence

T1505.003 Web Shell

Affected products and versions in Head Mare Breaches TrueConf Servers to Trojanize Client

  • TrueConf — TrueConf Server
    Vulnerable versions: 5.3.x before 5.3.9; 5.4.x before 5.4.9; 5.5.x before 5.5.5
    Fixed in: 5.3.9; 5.4.9; 5.5.5
  • TrueConf — TrueConf Client
    Vulnerable versions: Any client installer served by a compromised, unpatched TrueConf Server prior to remediation
    Fixed in: Reinstall from a verified, digitally-signed source after the server is patched

Remediation for Head Mare Breaches TrueConf Servers to Trojanize Client

Patches

  • TrueConf Server 5.3.9
  • TrueConf Server 5.4.9
  • TrueConf Server 5.5.5 (released 2026-06-18)

Immediate actions

  • Upgrade TrueConf Server to 5.3.9, 5.4.9, or 5.5.5 immediately
  • Block or restrict inbound access to TCP/4307 to trusted management hosts only; it is unauthenticated and open by default
  • Audit the TrueConf server web root, especially public/js/locale.php, for unauthorized modifications and remove any web shell found
  • Verify the digital signature of the TrueConf Client installer before it is trusted or executed; block/quarantine unsigned installers
  • Hunt for SysExcSvc.dll, SysReadSvc.dll, unexpected LSASS access, and reverse SSH tunnel activity on hosts that connected to internal TrueConf servers

Workarounds

  • Restrict TCP/4307 exposure via firewall/ACL until the server is patched
  • Disable or manually verify automatic client-installer distribution from TrueConf servers pending upgrade

Longer-term hardening

  • Deploy EDR with LSASS-access monitoring and credential-dumping detection
  • Monitor and baseline outbound traffic to Microsoft OneDrive/Graph endpoints from non-standard processes, since it is being used as a C2 channel
  • Segment TrueConf server infrastructure from the broader enterprise network
  • Enforce code-signing verification for all internally distributed software updates, including video-conferencing client installers

Timeline of Head Mare Breaches TrueConf Servers to Trojanize Client

  • TrueConf released Server versions 5.3.9, 5.4.9, and 5.5.5, fixing the KLCERT-26-057 and KLCERT-26-058 vulnerabilities Head Mare had been exploiting.
  • A separate PhantomGraph backdoor (SysExcSvc.dll, SysReadSvc.dll) was observed on victim hosts, receiving commands via a Microsoft OneDrive account and performing LSASS memory dumping, hostname/whoami reconnaissance, and reverse SSH tunneling.
  • Using database access obtained via the web shell, Head Mare replaced the legitimate TrueConf Client installer hosted on the server with an unsigned, trojanized build bundling the PhantomCore backdoor.
  • The group replaced public/js/locale.php on the compromised TrueConf server with a web shell, providing persistent remote access.
  • Attackers chained KLCERT-26-057 (malicious script execution in TrueConf's isolated environment) and KLCERT-26-058 (sandbox escape) to execute OS commands as NT AUTHORITY\SYSTEM.
  • Head Mare reached the TrueConf server management interface over unauthenticated TCP/4307, which is open by default.
  • Kaspersky researchers discovered the Head Mare campaign abusing unpatched TrueConf servers to distribute trojanized client installers carrying the PhantomCore backdoor (month-level date; exact day not disclosed in public reporting).
  • Russian-language outlets (anti-malware.ru, CNews) reported on Kaspersky's findings, corroborating the exploitation chain and patch details.
  • BleepingComputer published English-language coverage; Kaspersky stated it was tracking multiple active Head Mare campaigns against Russian organizations across instrumentation, electronics, transportation, energy, IT, and software-development sectors.

Sources cited for Head Mare Breaches TrueConf Servers to Trojanize Client

Threats related to Head Mare Breaches TrueConf Servers to Trojanize Client

Detection coverage for TL-2026-1945

As of 2026-08-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1945 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats