# Head Mare Breaches TrueConf Servers to Trojanize Client Installers with PhantomCore/PhantomGraph Backdoors

> The Head Mare hacktivist group exploited two unpatched vulnerabilities (KLCERT-26-057, KLCERT-26-058) in TrueConf video conferencing servers over unauthenticated TCP/4307 to plant a web shell, escalate to NT AUTHORITY\SYSTEM, and trojanize the legitimate TrueConf Client installer with the PhantomCore backdoor. A second backdoor, PhantomGraph (SysExcSvc.dll/SysReadSvc.dll), was deployed on victim hosts and receives commands via a Microsoft OneDrive account. Kaspersky discovered the campaign in July 2026, targeting Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development.

- **Published:** 2026-08-08T00:00:00Z
- **Last reviewed:** 2026-08-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1945
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-head-mare-trojanized-trueconf-installers-tl-2026-1945.webp?v=1a951dce (Threadlinqs threat intel: Head Mare Trojanized TrueConf Installers: Detection & IOCs (TL-2026-1945) — High severity, 10 IOCs, 9 detection rules.)
- **ID:** TL-2026-1945
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Head Mare
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

Head Mare, a pro-Ukraine hacktivist collective that has targeted Russian and Belarusian organizations since 2023, compromised on-premise TrueConf video conferencing servers to run a supply-chain attack against everyone who connects to them. The group reached TrueConf's management interface over TCP/4307, a port that is open by default and requires no authentication. Two chained flaws tracked internally by Kaspersky as KLCERT-26-057 (arbitrary script execution inside TrueConf's isolated/sandboxed execution environment) and KLCERT-26-058 (sandbox escape enabling OS-level command execution) let the attackers execute commands as NT AUTHORITY\SYSTEM on the underlying Windows host.

With SYSTEM-level access, Head Mare replaced the legitimate server file public/js/locale.php with a web shell, giving them persistent remote access. That access was used to reach the TrueConf server's database and to harvest sensitive environment information. Critically, the attackers used the database access to swap the legitimate, digitally-signed TrueConf Client installer hosted on the server for an unsigned, trojanized build carrying the PhantomCore backdoor. Because organizations' own employees fetch the client installer directly from their internal TrueConf server when joining a call, this converts a single compromised server into a distribution point that silently backdoors every subsequent connecting user — a supply-chain compromise rather than a one-off intrusion.

A second, functionally separate backdoor — PhantomGraph, implemented as two DLLs named SysExcSvc.dll and SysReadSvc.dll — was also observed on affected hosts. PhantomGraph receives commands via a Microsoft OneDrive account (blending its C2 traffic with legitimate cloud storage activity) and returns execution results over the same channel. Observed operator activity through PhantomGraph includes dumping LSASS process memory for credential theft, basic host reconnaissance (hostname, whoami), and establishing reverse SSH tunnels back to attacker-controlled infrastructure.

TrueConf fixed the exploited vulnerabilities on 2026-06-18 in Server versions 5.3.9, 5.4.9, and 5.5.5; any instance still on an earlier 5.3.x, 5.4.x, or 5.5.x build remains exposed. Kaspersky states it is tracking multiple active Head Mare campaigns against Russian organizations concurrently.

This is one of several distinct campaigns in which Head Mare has abused TrueConf as a supply-chain vector — an earlier campaign (approximately September 2025–February 2026) exploited a different set of vulnerabilities (BDU:2025-10114/10115/10116, patched August 2025) to deploy a different backdoor (PhantomPxPigeon); those are documented separately and are NOT part of this record. Likewise, a separate April 2026 campaign referencing CVE-2026-3502 ("Operation True Chaos") used a similar trojanized-update delivery mechanism but is tentatively attributed to a distinct, Havoc-implant-linked Chinese actor and is unrelated to Head Mare's July 2026 PhantomCore/PhantomGraph activity documented here.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1505.003 Web Shell
- T1059.003 Windows Command Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1003.001 LSASS Memory
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1102.002 Bidirectional Communication
- T1572 Protocol Tunneling

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TrueConf TCP/4307 Exploit Chain (KLCERT-26-057/058) Yields SYSTEM Shell Spawn** (`TL-2026-1945-SPL-001`)

Detects the Head Mare initial-access-to-privilege pivot: an inbound connection to TrueConf's unauthenticated management port TCP/4307 (open by default) followed within minutes by a TrueConf server process spawning cmd.exe/powershell.exe running as NT AUTHORITY\SYSTEM. This is the network-to-host signature produced by chaining KLCERT-26-057 (arbitrary script execution inside TrueConf's sandboxed environment) with KLCERT-26-058 (sandbox escape to OS command execution).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.003
- **Data sources:** firewall_network_flow, windows_security_eventlog, sysmon
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network (sourcetype="cisco:asa" OR sourcetype="pan:traffic" OR sourcetype="fw:allow") dest_port=4307 action=allowed
| eval flow_key=src_ip
| join type=inner max=0 flow_key
    [ search index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*trueconf*" (Image="*\\cmd.exe" OR Image="*\\powershell.exe") User="*SYSTEM*"
      | eval flow_key=Computer
      | rename _time as spawn_time, Image as child_process, CommandLine as child_cmdline ]
| where (spawn_time - _time) >= 0 AND (spawn_time - _time) <= 300
| table _time, src_ip, dest_ip, dest_port, Computer, child_process, child_cmdline, spawn_time
| sort -_time
```

### Microsoft KQL

```kql
let netHits = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort == 4307 and ActionType == "ConnectionSuccess"
| project NetTime = Timestamp, DeviceId, DeviceName, RemoteIP, LocalIP;
let procHits = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("tcsrv", "trueconf", "TrueConfServer")
| where FileName in~ ("cmd.exe", "powershell.exe", "powershell_ise.exe")
| where InitiatingProcessAccountName has "SYSTEM"
| project ProcTime = Timestamp, DeviceId, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName;
netHits
| join kind=inner procHits on DeviceId
| where ProcTime - NetTime between (0min .. 5min)
| project NetTime, ProcTime, DeviceName, RemoteIP, InitiatingProcessFileName, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: TrueConf Server SYSTEM Shell Spawn Following TCP/4307 Exploit Probe
id: 7c1a2e9e-2b0e-4b3a-9d0c-2f5c9a1e6b31
status: experimental
description: Detects a command interpreter spawned by a TrueConf server process running as NT AUTHORITY\SYSTEM shortly after inbound traffic to the unauthenticated management port TCP/4307, consistent with the Head Mare KLCERT-26-057/058 exploit chain.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/
    - https://securelist.com/head-mare-hacktivists/113555/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-09
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.003
    - attack.tool.phantomcore
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - 'trueconf'
            - 'tcsrv'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    selection_user:
        User|contains: 'SYSTEM'
    condition: selection_parent and selection_child and selection_user
falsepositives:
    - Legitimate TrueConf server maintenance scripts invoked by administrators under a scheduled task running as SYSTEM
level: high
```

**Known false positives:**

- Authorized administrator remote-management sessions to TCP/4307 followed by legitimate SYSTEM-scheduled maintenance scripts on the TrueConf host

**Tuning notes:** Scope the network selection to known TrueConf server host IPs via an asset-list lookup to avoid noisy joins across unrelated hosts; widen or tighten the 5-minute correlation window based on observed clock skew between firewall and endpoint logging.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Burst TCP/4307 Connection Attempts Correlated with SYSTEM Shell Spawn on TrueConf Host (locked: unlock with TL Creds)
- PhantomGraph DLL ([indicator]/[indicator]) Load with LSASS Access and Host Recon (locked: unlock with TL Creds)
- Reverse SSH Tunnel Process Launch with Prior OneDrive/Graph C2 Beacon Context (locked: unlock with TL Creds)
- TrueConf Server Component Spawns Shell/LOLBin as SYSTEM (Sandbox-Escape Signature) (locked: unlock with TL Creds)
- Unsigned or Mis-Signed TrueConf Client Installer Execution (Trojanized Supply-Chain Payload) (locked: unlock with TL Creds)
- Correlated PhantomGraph C2 Pattern — OneDrive/Graph Beacon and Reverse SSH Tunnel on Same Host (locked: unlock with TL Creds)
- TrueConf [indicator] Web Shell Persistence (Masquerading as a Legitimate Server File) (locked: unlock with TL Creds)
- PhantomGraph OneDrive/Graph C2 Beacon Followed by Reverse SSH Tunnel Establishment (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Hackers breach TrueConf to trojanize client installers with backdoors](https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/)
- [TrueConf Breach Exposes Client Installers to Trojanized Backdoors](https://www.news4hackers.com/trueconf-breach-exposes-client-installers-to-trojanized-backdoors)
- [Хакеры превращают серверы TrueConf в раздатчики бэкдоров](https://www.anti-malware.ru/news/2026-08-07-111332/50952)
- [Российские организации столкнулись с новой волной атак через уязвимости в необновлённых серверах TrueConf](https://safe.cnews.ru/news/line/2026-08-07_rossijskie_organizatsii_stolknulis)
- [PhantomCore backdoor distributed in recent Head Mare campaign](https://www.broadcom.com/support/security-center/protection-bulletin/phantomcore-backdoor-distributed-in-recent-head-mare-campaign)
- [Head Mare hacktivists: attacks on companies in Russia and Belarus](https://securelist.com/head-mare-hacktivists/113555/)
- [Head Mare Deploys PhantomCore Against Russia](https://cyble.com/blog/head-mare-deploys-phantomcore-against-russia/)
- [PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks (related, distinct Head Mare TrueConf campaign, Sept 2025-Feb 2026)](https://thehackernews.com/2026/04/phantomcore-exploits-trueconf.html)
- [Новая кампания Head Mare с бэкдором PhantomPxPigeon (related, distinct earlier Head Mare TrueConf campaign)](https://securelist.ru/head-mare-campaign-phantompxpigeon-backdoor-and-trueconf-software/114998/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1945