Head Mare APT Exploits Unpatched TrueConf Server Flaws to Deploy PhantomCore and PhantomGraph Backdoors

Head Mare APT Exploits Unpatched TrueConf Server Flaws to (TL-2026-1982) is a critical-severity advanced persistent threat campaign, first published 2026-08-11. It is attributed to Head Mare with medium confidence, affects TrueConf TrueConf Server, maps to 16 MITRE ATT&CK techniques (T1003.001, T1020, T1033), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-1982

Threat ID
TL-2026-1982
Severity
CRITICAL
Status
ACTIVE
Category
APT
First published
2026-08-11
Last reviewed
2026-08-11
Attribution
Head Mare
Attribution confidence
MEDIUM
Motivation
ESPIONAGE
Target sectors
instrument manufacturing, electronics, transport, energy, information technology, software development
Target regions
russia
Detection rules
9
Indicators of compromise
28

Malware and tooling in Head Mare APT Exploits Unpatched TrueConf Server Flaws to

Malware and tooling: PhantomCore

Kaspersky (Securelist) reports that in July 2026 the Head Mare group, recently reclassified from hacktivist to APT, chained two unauthenticated vulnerabilities (KLCERT-26-057, KLCERT-26-058) in unpatched TrueConf Server (5.3.X-5.3.9, 5.4.X-5.4.9, 5.5.X-5.5.5) to gain NT AUTHORITY\SYSTEM access, plant a PHP web shell, trojanize the TrueConf Client installer with the PhantomCore backdoor, and deploy the dual-module PhantomGraph backdoor (SysExcSvc.dll/SysReadSvc.dll) against Russian instrument-manufacturing, electronics, transportation, energy, IT, and software-development organizations.

How Head Mare APT Exploits Unpatched TrueConf Server Flaws to works

In July 2026, Kaspersky's Securelist detected in-the-wild exploitation of two vulnerabilities in TrueConf Server, an on-premises video-conferencing platform, by the Head Mare group -- a cluster Kaspersky has now reclassified from hacktivist to advanced persistent threat based on the sophistication of its tradecraft. The attack chain began with an unauthenticated connection to TCP/4307, open by default on vulnerable TrueConf Server builds (versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, and 5.5.X through 5.5.5). KLCERT-26-057 allowed the attacker to transmit and execute a malicious script inside TrueConf's isolated execution environment; KLCERT-26-058 then let that script escape the sandbox and run arbitrary OS-level commands, escalating to NT AUTHORITY\SYSTEM. TrueConf shipped patches for both flaws on June 18, 2026 (5.3.9, 5.4.9, 5.5.5), but the attacks Kaspersky observed occurred against servers that had not applied them.

With SYSTEM-level access, the operators replaced '...\public\js\locale.php' with a PHP web shell (MD5 4d27b4eb1c5dbb3d8160f29b8119523e) for persistent remote access, then used that access to enumerate the server's infrastructure, escalate privileges inside the TrueConf database, and replace the legitimate TrueConf Client installer with a trojanized build carrying the PhantomCore backdoor. Because the malicious installer lacks TrueConf's valid code-signing signature, organizations that update their clients from a compromised server -- including third-party or partner TrueConf servers -- are exposed even if their own infrastructure is patched, turning the compromise into a software-supply-chain-style distribution vector. PhantomCore is a Windows backdoor that persists via a COM-hijacking registry key under HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32.

Alongside PhantomCore, the operators deployed PhantomGraph, a modular Windows backdoor split across two DLLs -- SysExcSvc.dll (receives operator commands and returns results) and SysReadSvc.dll (executes the commands, largely via dropped batch files) -- installed as Windows services (SysExcSvc/SysReadSvc) through Base64-encoded PowerShell one-liners, and staged under C:\Windows\System32\inetsrv\. PhantomGraph's command-and-control channel rides Microsoft OneDrive cloud-storage accounts rather than a dedicated C2 server, and the operators separately established SSH reverse tunnels for interactive access. Post-exploitation activity included dumping LSASS process memory for credential theft and basic host/user reconnaissance (hostname, whoami). Kaspersky's telemetry also ties the intrusion set to Linux ELF backdoors and a rootkit, indicating a cross-platform toolkit rather than a Windows-only operation.

Head Mare has targeted TrueConf infrastructure before: per The Hacker News, the group exploited a separate set of TrueConf vulnerabilities (BDU:2025-10114, BDU:2025-10115, BDU-2025-10116) to deliver PHP web shells beginning around September 2025, with that campaign publicly disclosed in April 2026. Targeting in the current campaign is confined to Russian organizations across instrument manufacturing, electronics, transportation, energy, IT, and software development -- sectors consistent with espionage-oriented rather than financially or ideologically motivated intrusion activity, notwithstanding the group's hacktivist origin.

MITRE ATT&CK techniques used in TL-2026-1982

Credential Access

T1003.001 LSASS Memory

Exfiltration

T1020 Automated Exfiltration

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1569.002 Service Execution

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain

Persistence

T1543.003 Windows Service; T1546.015 Component Object Model Hijacking

Affected products and versions in Head Mare APT Exploits Unpatched TrueConf Server Flaws to

  • TrueConf — TrueConf Server
    Vulnerable versions: 5.3.X - 5.3.8; 5.4.X - 5.4.8; 5.5.X - 5.5.4; earlier releases
    Fixed in: 5.3.9; 5.4.9; 5.5.5

Remediation for Head Mare APT Exploits Unpatched TrueConf Server Flaws to

Patches

  • TrueConf Server 5.3.9
  • TrueConf Server 5.4.9
  • TrueConf Server 5.5.5

Immediate actions

  • Apply TrueConf Server patches (5.3.9, 5.4.9, or 5.5.5, or later) immediately
  • Verify TrueConf Client installer digital signatures against the vendor's official distribution before install or update
  • Restrict or firewall inbound TCP/4307 to trusted management networks only
  • Hunt for a web shell at '...\public\js\locale.php' (MD5 4d27b4eb1c5dbb3d8160f29b8119523e) and for unsigned TrueConf installer executables

Workarounds

  • Restrict TCP/4307 to trusted management networks only if patching cannot occur immediately
  • Take unpatched TrueConf Server instances offline or isolate them from client update distribution until patched

Longer-term hardening

  • Monitor registry writes under CLSID {0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 for COM-hijacking persistence
  • Alert on creation of the SysExcSvc/SysReadSvc Windows services and new files under C:\Windows\System32\inetsrv\
  • Detect LSASS memory access (including via comsvcs.dll) correlated with TrueConf server or client processes
  • Monitor for anomalous OneDrive API traffic used as a C2 channel and for unexpected outbound SSH reverse tunnels
  • Require code-signature verification for all software update mechanisms distributed via internal collaboration servers

Timeline of Head Mare APT Exploits Unpatched TrueConf Server Flaws to

  • Head Mare begins exploiting an earlier, separate set of TrueConf vulnerabilities (BDU:2025-10114, BDU:2025-10115, BDU-2025-10116) to deliver PHP web shells, per The Hacker News.
  • Head Mare's earlier TrueConf-targeting campaign (BDU:2025-10114/10115/10116) is publicly disclosed.
  • TrueConf releases patches for KLCERT-26-057 and KLCERT-26-058 in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5.
  • Head Mare exploits unpatched TrueConf Server instances via unauthenticated access to TCP/4307, chaining KLCERT-26-057 and KLCERT-26-058 to obtain NT AUTHORITY\SYSTEM access.
  • Operators replace '...\public\js\locale.php' with a PHP web shell (MD5 4d27b4eb1c5dbb3d8160f29b8119523e) to maintain persistent remote access to the compromised TrueConf server.
  • The legitimate TrueConf Client installer is replaced with an unsigned, trojanized build carrying the PhantomCore backdoor, exposing users who update from the compromised server.
  • The dual-module PhantomGraph backdoor (SysExcSvc.dll/SysReadSvc.dll) is installed as Windows services via Base64-encoded PowerShell commands, using Microsoft OneDrive accounts for command-and-control.
  • Operators dump LSASS process memory for credential theft, perform host/user reconnaissance (hostname, whoami), and establish SSH reverse tunnels for interactive access.
  • Kaspersky Securelist publishes a detailed report on the Head Mare TrueConf campaign, including IOCs and detection guidance.

Sources cited for Head Mare APT Exploits Unpatched TrueConf Server Flaws to

Threats related to Head Mare APT Exploits Unpatched TrueConf Server Flaws to

Detection coverage for TL-2026-1982

As of 2026-08-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1982 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats