Skip to navigation

Threat reportSupply ChainTL-2026-1945

Head Mare Breaches TrueConf Servers to Trojanize Client Installers with PhantomCore/PhantomGraph Backdoors

highACTIVE

The Head Mare hacktivist group exploited two unpatched vulnerabilities (KLCERT-26-057, KLCERT-26-058) in TrueConf video conferencing servers over unauthenticated TCP/4307 to plant a web shell, escalate to NT AUTHORITY\SYSTEM, and trojanize the legitimate TrueConf Client installer with the PhantomCore backdoor. A second backdoor, PhantomGraph (SysExcSvc.dll/SysReadSvc.dll), was deployed on victim hosts and receives commands via a Microsoft OneDrive account.

Key facts for Head Mare trojanized TrueConf installers

IdentifiersTL-2026-1945
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsTrueConf TrueConf Server; TrueConf TrueConf Client
AttributionHead Mare (high confidence)
MalwarePhantomCore, PhantomGraph
ToolsCustom PHP web shell (locale.php replacement), Microsoft OneDrive
MITRE ATT&CK techniquesT1003.001 LSASS Memory, T1033 System Owner/User Discovery, T1036.005 Match Legitimate Resource Name or Location, T1059.003 Windows Command Shell, T1082 System Information Discovery, T1102.002 Bidirectional Communication, T1190 Exploit Public-Facing Application, T1195.002 Compromise Software Supply Chain, T1505.003 Web Shell, T1572 Protocol Tunneling
MotivationHACKTIVISM
Target sectorsinstrumentation, electronics, transport, energy, information technology, software development
Target regionsrussia
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for Head Mare trojanized TrueConf installers

As of 2026-08-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1945 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TrueConf TCP/4307 Exploit Chain (KLCERT-26-057/058) Yields SYSTEM Shell Spawn

Detects the Head Mare initial-access-to-privilege pivot: an inbound connection to TrueConf's unauthenticated management port TCP/4307 (open by default) followed within minutes by a TrueConf server process spawning cmd.exe/powershell.exe running as NT AUTHORITY\SYSTEM. This is the network-to-host signature produced by chaining KLCERT-26-057 (arbitrary script execution inside TrueConf's sandboxed environment) with KLCERT-26-058 (sandbox escape to OS command execution).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059.003
  • Data sources: firewall_network_flow, windows_security_eventlog, sysmon
  • Severity: critical
  • Confidence: high

Splunk SPL

index=network (sourcetype="cisco:asa" OR sourcetype="pan:traffic" OR sourcetype="fw:allow") dest_port=4307 action=allowed
| eval flow_key=src_ip
| join type=inner max=0 flow_key
    [ search index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*trueconf*" (Image="*\\cmd.exe" OR Image="*\\powershell.exe") User="*SYSTEM*"
      | eval flow_key=Computer
      | rename _time as spawn_time, Image as child_process, CommandLine as child_cmdline ]
| where (spawn_time - _time) >= 0 AND (spawn_time - _time) <= 300
| table _time, src_ip, dest_ip, dest_port, Computer, child_process, child_cmdline, spawn_time
| sort -_time

Microsoft KQL

let netHits = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort == 4307 and ActionType == "ConnectionSuccess"
| project NetTime = Timestamp, DeviceId, DeviceName, RemoteIP, LocalIP;
let procHits = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("tcsrv", "trueconf", "TrueConfServer")
| where FileName in~ ("cmd.exe", "powershell.exe", "powershell_ise.exe")
| where InitiatingProcessAccountName has "SYSTEM"
| project ProcTime = Timestamp, DeviceId, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName;
netHits
| join kind=inner procHits on DeviceId
| where ProcTime - NetTime between (0min .. 5min)
| project NetTime, ProcTime, DeviceName, RemoteIP, InitiatingProcessFileName, FileName, ProcessCommandLine

Sigma

title: TrueConf Server SYSTEM Shell Spawn Following TCP/4307 Exploit Probe
id: 7c1a2e9e-2b0e-4b3a-9d0c-2f5c9a1e6b31
status: experimental
description: Detects a command interpreter spawned by a TrueConf server process running as NT AUTHORITY\SYSTEM shortly after inbound traffic to the unauthenticated management port TCP/4307, consistent with the Head Mare KLCERT-26-057/058 exploit chain.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/
    - https://securelist.com/head-mare-hacktivists/113555/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-09
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.003
    - attack.tool.phantomcore
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - 'trueconf'
            - 'tcsrv'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    selection_user:
        User|contains: 'SYSTEM'
    condition: selection_parent and selection_child and selection_user
falsepositives:
    - Legitimate TrueConf server maintenance scripts invoked by administrators under a scheduled task running as SYSTEM
level: high

Known false positives:

  • Authorized administrator remote-management sessions to TCP/4307 followed by legitimate SYSTEM-scheduled maintenance scripts on the TrueConf host

Tuning notes: Scope the network selection to known TrueConf server host IPs via an asset-list lookup to avoid noisy joins across unrelated hosts; widen or tighten the 5-minute correlation window based on observed clock skew between firewall and endpoint logging.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Burst TCP/4307 Connection Attempts Correlated with SYSTEM Shell Spawn on TrueConf Host · unlock with TL Creds
  • PhantomGraph DLL ([indicator]/[indicator]) Load with LSASS Access and Host Recon · unlock with TL Creds
  • Reverse SSH Tunnel Process Launch with Prior OneDrive/Graph C2 Beacon Context · unlock with TL Creds
  • TrueConf Server Component Spawns Shell/LOLBin as SYSTEM (Sandbox-Escape Signature) · unlock with TL Creds
  • Unsigned or Mis-Signed TrueConf Client Installer Execution (Trojanized Supply-Chain Payload) · unlock with TL Creds
  • Correlated PhantomGraph C2 Pattern — OneDrive/Graph Beacon and Reverse SSH Tunnel on Same Host · unlock with TL Creds
  • TrueConf [indicator] Web Shell Persistence (Masquerading as a Legitimate Server File) · unlock with TL Creds
  • PhantomGraph OneDrive/Graph C2 Beacon Followed by Reverse SSH Tunnel Establishment · unlock with TL Creds

Indicators of compromise for Head Mare trojanized TrueConf installers

As of 2026-08-08, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-1945.

10 indicators of compromise · unlock with TL Creds. Compare plans

How Head Mare trojanized TrueConf installers works

Kaspersky discovered the campaign in July 2026, targeting Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development.

Head Mare, a pro-Ukraine hacktivist collective that has targeted Russian and Belarusian organizations since 2023, compromised on-premise TrueConf video conferencing servers to run a supply-chain attack against everyone who connects to them. The group reached TrueConf's management interface over TCP/4307, a port that is open by default and requires no authentication. Two chained flaws tracked internally by Kaspersky as KLCERT-26-057 (arbitrary script execution inside TrueConf's isolated/sandboxed execution environment) and KLCERT-26-058 (sandbox escape enabling OS-level command execution) let the attackers execute commands as NT AUTHORITY\SYSTEM on the underlying Windows host.

With SYSTEM-level access, Head Mare replaced the legitimate server file public/js/locale.php with a web shell, giving them persistent remote access. That access was used to reach the TrueConf server's database and to harvest sensitive environment information. Critically, the attackers used the database access to swap the legitimate, digitally-signed TrueConf Client installer hosted on the server for an unsigned, trojanized build carrying the PhantomCore backdoor. Because organizations' own employees fetch the client installer directly from their internal TrueConf server when joining a call, this converts a single compromised server into a distribution point that silently backdoors every subsequent connecting user — a supply-chain compromise rather than a one-off intrusion.

A second, functionally separate backdoor — PhantomGraph, implemented as two DLLs named SysExcSvc.dll and SysReadSvc.dll — was also observed on affected hosts. PhantomGraph receives commands via a Microsoft OneDrive account (blending its C2 traffic with legitimate cloud storage activity) and returns execution results over the same channel. Observed operator activity through PhantomGraph includes dumping LSASS process memory for credential theft, basic host reconnaissance (hostname, whoami), and establishing reverse SSH tunnels back to attacker-controlled infrastructure.

TrueConf fixed the exploited vulnerabilities on 2026-06-18 in Server versions 5.3.9, 5.4.9, and 5.5.5; any instance still on an earlier 5.3.x, 5.4.x, or 5.5.x build remains exposed. Kaspersky states it is tracking multiple active Head Mare campaigns against Russian organizations concurrently.

This is one of several distinct campaigns in which Head Mare has abused TrueConf as a supply-chain vector — an earlier campaign (approximately September 2025–February 2026) exploited a different set of vulnerabilities (BDU:2025-10114/10115/10116, patched August 2025) to deploy a different backdoor (PhantomPxPigeon); those are documented separately and are NOT part of this record. Likewise, a separate April 2026 campaign referencing CVE-2026-3502 ("Operation True Chaos") used a similar trojanized-update delivery mechanism but is tentatively attributed to a distinct, Havoc-implant-linked Chinese actor and is unrelated to Head Mare's July 2026 PhantomCore/PhantomGraph activity documented here.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.003 Windows Command Shell

Command and Control

T1102.002 Bidirectional Communication; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain

Persistence

T1505.003 Web Shell

Remediation for Head Mare trojanized TrueConf installers

Patches

  • TrueConf Server 5.3.9
  • TrueConf Server 5.4.9
  • TrueConf Server 5.5.5 (released 2026-06-18)

Immediate actions

  • Upgrade TrueConf Server to 5.3.9, 5.4.9, or 5.5.5 immediately
  • Block or restrict inbound access to TCP/4307 to trusted management hosts only; it is unauthenticated and open by default
  • Audit the TrueConf server web root, especially public/js/locale.php, for unauthorized modifications and remove any web shell found
  • Verify the digital signature of the TrueConf Client installer before it is trusted or executed; block/quarantine unsigned installers
  • Hunt for SysExcSvc.dll, SysReadSvc.dll, unexpected LSASS access, and reverse SSH tunnel activity on hosts that connected to internal TrueConf servers

Workarounds

  • Restrict TCP/4307 exposure via firewall/ACL until the server is patched
  • Disable or manually verify automatic client-installer distribution from TrueConf servers pending upgrade

Longer-term hardening

  • Deploy EDR with LSASS-access monitoring and credential-dumping detection
  • Monitor and baseline outbound traffic to Microsoft OneDrive/Graph endpoints from non-standard processes, since it is being used as a C2 channel
  • Segment TrueConf server infrastructure from the broader enterprise network
  • Enforce code-signing verification for all internally distributed software updates, including video-conferencing client installers

Affected and fixed versions

  • TrueConf — TrueConf Server
    Vulnerable versions: 5.3.x before 5.3.9; 5.4.x before 5.4.9; 5.5.x before 5.5.5
    Fixed in: 5.3.9; 5.4.9; 5.5.5
  • TrueConf — TrueConf Client
    Vulnerable versions: Any client installer served by a compromised, unpatched TrueConf Server prior to remediation
    Fixed in: Reinstall from a verified, digitally-signed source after the server is patched

Timeline of Head Mare trojanized TrueConf installers

  • locked-ioc-10 released Server versions 5.3.9, 5.4.9, and 5.5.5, fixing the KLCERT-26-057 and KLCERT-26-058 vulnerabilities Head Mare had been exploiting.
  • A separate locked-ioc-8 backdoor (locked-ioc-7, locked-ioc-6) was observed on victim hosts, receiving commands via a locked-ioc-5 account and performing LSASS memory dumping, hostname/whoami reconnaissance, and reverse SSH tunneling.
  • Using database access obtained via the web shell, Head Mare replaced the legitimate locked-ioc-10 Client installer hosted on the server with an unsigned, trojanized build bundling the locked-ioc-9 backdoor.
  • The group replaced locked-ioc-4 on the compromised locked-ioc-10 server with a web shell, providing persistent remote access.
  • Attackers chained KLCERT-26-057 (malicious script execution in locked-ioc-10's isolated environment) and KLCERT-26-058 (sandbox escape) to execute OS commands as NT AUTHORITY\SYSTEM.
  • Head Mare reached the locked-ioc-10 server management interface over unauthenticated TCP/4307, which is open by default.
  • Kaspersky researchers discovered the Head Mare campaign abusing unpatched locked-ioc-10 servers to distribute trojanized client installers carrying the locked-ioc-9 backdoor (month-level date; exact day not disclosed in public reporting).
  • Russian-language outlets (anti-malware.ru, CNews) reported on Kaspersky's findings, corroborating the exploitation chain and patch details.
  • BleepingComputer published English-language coverage; Kaspersky stated it was tracking multiple active Head Mare campaigns against Russian organizations across instrumentation, electronics, transportation, energy, IT, and software-development sectors.

Sources cited for Head Mare trojanized TrueConf installers

More from Head Mare

Previous and next in supply chain

Further reading

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats