# Head Mare APT Exploits Unpatched TrueConf Server Flaws to Deploy PhantomCore and PhantomGraph Backdoors

> Kaspersky (Securelist) reports that in July 2026 the Head Mare group, recently reclassified from hacktivist to APT, chained two unauthenticated vulnerabilities (KLCERT-26-057, KLCERT-26-058) in unpatched TrueConf Server (5.3.X-5.3.9, 5.4.X-5.4.9, 5.5.X-5.5.5) to gain NT AUTHORITY\SYSTEM access, plant a PHP web shell, trojanize the TrueConf Client installer with the PhantomCore backdoor, and deploy the dual-module PhantomGraph backdoor (SysExcSvc.dll/SysReadSvc.dll) against Russian instrument-manufacturing, electronics, transportation, energy, IT, and software-development organizations.

- **Published:** 2026-08-11T00:00:00Z
- **Last reviewed:** 2026-08-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1982
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-head-mare-apt-exploits-unpatched-trueconf-server-flaws-to-tl-2026-1982.webp?v=055c435e (Threadlinqs threat intel: Head Mare APT Exploits Unpatched TrueConf Server Flaws to… (TL-2026-1982) — Critical severity, 28 IOCs, 9 detection rules.)
- **ID:** TL-2026-1982
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Head Mare
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below)

## Description

In July 2026, Kaspersky's Securelist detected in-the-wild exploitation of two vulnerabilities in TrueConf Server, an on-premises video-conferencing platform, by the Head Mare group -- a cluster Kaspersky has now reclassified from hacktivist to advanced persistent threat based on the sophistication of its tradecraft. The attack chain began with an unauthenticated connection to TCP/4307, open by default on vulnerable TrueConf Server builds (versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, and 5.5.X through 5.5.5). KLCERT-26-057 allowed the attacker to transmit and execute a malicious script inside TrueConf's isolated execution environment; KLCERT-26-058 then let that script escape the sandbox and run arbitrary OS-level commands, escalating to NT AUTHORITY\SYSTEM. TrueConf shipped patches for both flaws on June 18, 2026 (5.3.9, 5.4.9, 5.5.5), but the attacks Kaspersky observed occurred against servers that had not applied them.

With SYSTEM-level access, the operators replaced '...\public\js\locale.php' with a PHP web shell (MD5 4d27b4eb1c5dbb3d8160f29b8119523e) for persistent remote access, then used that access to enumerate the server's infrastructure, escalate privileges inside the TrueConf database, and replace the legitimate TrueConf Client installer with a trojanized build carrying the PhantomCore backdoor. Because the malicious installer lacks TrueConf's valid code-signing signature, organizations that update their clients from a compromised server -- including third-party or partner TrueConf servers -- are exposed even if their own infrastructure is patched, turning the compromise into a software-supply-chain-style distribution vector. PhantomCore is a Windows backdoor that persists via a COM-hijacking registry key under HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32.

Alongside PhantomCore, the operators deployed PhantomGraph, a modular Windows backdoor split across two DLLs -- SysExcSvc.dll (receives operator commands and returns results) and SysReadSvc.dll (executes the commands, largely via dropped batch files) -- installed as Windows services (SysExcSvc/SysReadSvc) through Base64-encoded PowerShell one-liners, and staged under C:\Windows\System32\inetsrv\. PhantomGraph's command-and-control channel rides Microsoft OneDrive cloud-storage accounts rather than a dedicated C2 server, and the operators separately established SSH reverse tunnels for interactive access. Post-exploitation activity included dumping LSASS process memory for credential theft and basic host/user reconnaissance (hostname, whoami). Kaspersky's telemetry also ties the intrusion set to Linux ELF backdoors and a rootkit, indicating a cross-platform toolkit rather than a Windows-only operation.

Head Mare has targeted TrueConf infrastructure before: per The Hacker News, the group exploited a separate set of TrueConf vulnerabilities (BDU:2025-10114, BDU:2025-10115, BDU-2025-10116) to deliver PHP web shells beginning around September 2025, with that campaign publicly disclosed in April 2026. Targeting in the current campaign is confined to Russian organizations across instrument manufacturing, electronics, transportation, energy, IT, and software development -- sectors consistent with espionage-oriented rather than financially or ideologically motivated intrusion activity, notwithstanding the group's hacktivist origin.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1569.002 Service Execution
- T1546.015 Component Object Model Hijacking
- T1543.003 Windows Service
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1003.001 LSASS Memory
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1572 Protocol Tunneling
- T1020 Automated Exfiltration

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TrueConf Server TCP/4307 Exploitation and locale.php Web Shell Drop (KLCERT-26-057/058)** (`TL-2026-1982-SPL-001`)

Detects the Head Mare exploitation chain against unpatched TrueConf Server: an unauthenticated connection to TCP/4307 (open by default, used to smuggle KLCERT-26-057's sandboxed script and KLCERT-26-058's sandbox-escape) correlated with the resulting file write that replaces ...\public\js\locale.php with a PHP web shell (MD5 4d27b4eb1c5dbb3d8160f29b8119523e), giving the attacker NT AUTHORITY\SYSTEM-level persistent remote access.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1036.005
- **Data sources:** firewall, sysmon, windows_security
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network OR index=firewall dest_port=4307
| eval src_zone=if(cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip),"internal","external")
| join type=inner dest_ip
    [ search index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*\\public\\js\\locale.php"
      | eval dest_ip=Computer
      | table dest_ip, _time, TargetFilename, Hashes, Image ]
| where match(Hashes,"MD5=4d27b4eb1c5dbb3d8160f29b8119523e") OR TargetFilename="*locale.php"
| table _time, src_ip, dest_ip, dest_port, src_zone, TargetFilename, Hashes, Image
| sort -_time
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort == 4307
| project Timestamp, DeviceName, LocalIP, RemoteIP, RemotePort, InitiatingProcessFileName
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has @"\public\js\locale.php"
    | project Timestamp, DeviceName, FolderPath, MD5, FileName
) on DeviceName
| project Timestamp, DeviceName, RemoteIP, RemotePort, FolderPath, MD5
| where MD5 == "4d27b4eb1c5dbb3d8160f29b8119523e" or isnotempty(FolderPath)
```

### Sigma

```yaml
title: TrueConf Server Web Shell Drop via locale.php Replacement
id: a1b2c3d4-1111-4aaa-8bbb-000000000001
status: experimental
description: Detects replacement of TrueConf Server's public/js/locale.php with a PHP web shell following exploitation of the KLCERT-26-057/KLCERT-26-058 sandbox-escape chain over TCP/4307 (Head Mare / PhantomCore campaign).
references:
    - https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|endswith: '\public\js\locale.php'
    selection_hash:
        Hashes|contains: '4d27b4eb1c5dbb3d8160f29b8119523e'
    condition: selection_path or selection_hash
falsepositives:
    - Legitimate TrueConf Server upgrade/patch process modifying locale.php (verify against vendor release notes and code signature)
level: critical
```

**Known false positives:**

- Legitimate TrueConf administrative traffic on TCP/4307 from patched, trusted management hosts with no corresponding locale.php write

**Tuning notes:** Restrict the port-4307 leg to hosts running vulnerable TrueConf Server builds (5.3.X-5.3.8, 5.4.X-5.4.8, 5.5.X-5.5.4) and exclude the confirmed-patched fleet (5.3.9/5.4.9/5.5.5+) once remediated.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unsigned or Known-Malicious TrueConf Client Installer Execution (locked: unlock with TL Creds)
- PhantomGraph SysExcSvc/SysReadSvc Service Installation via Base64-Encoded PowerShell (locked: unlock with TL Creds)
- Outbound SSH Connection to Head Mare Reverse Tunnel Infrastructure (locked: unlock with TL Creds)
- Command Execution Spawned from Web Server Process Following locale.php Web Shell Access (locked: unlock with TL Creds)
- LSASS Memory Access and Host Reconnaissance Following PhantomGraph Service Execution (locked: unlock with TL Creds)
- Batch Script Execution by PhantomGraph SysReadSvc with Outbound Connection to Head Mare Attack Infrastructure (locked: unlock with TL Creds)
- PhantomCore COM Hijacking Persistence via CLSID InprocServer32 Registry Key (locked: unlock with TL Creds)
- Anomalous OneDrive API Traffic Initiated by PhantomGraph Service Process (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 28)

Defanged, TLP:CLEAR.

- IP address: `81.177.32[.]12`
- Domain: `penzadogshelter[.]site`
- File hash: `4d27b4eb1c5dbb3d8160f29b8119523e`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants](https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/)
- [Hackers breach TrueConf to trojanize client installers with backdoors](https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/)
- [TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore](https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html)
- [Hacktivist group Head Mare exploits TrueConf vulnerabilities to deliver backdoors](https://www.scworld.com/brief/hacktivist-group-head-mare-exploits-trueconf-vulnerabilities-to-deliver-backdoors)
- [Active Exploitation Alert: Head Mare Hacktivists Exploit TrueConf Vulnerabilities to Trojanize Client Installers with PhantomCore and PhantomGraph Backdoors](https://www.rescana.com/post/active-exploitation-alert-head-mare-hacktivists-exploit-trueconf-vulnerabilities-to-trojanize-client-installers-with-pha)
- [LeakWatch CW 32/2026: Metabase Zero-Day and Xbox Leak (TrueConf becomes malware gateway)](https://www.igorslab.de/en/leakwatch-cw-32-2026-metabase-zero-day-hits-framework-trueconf-becomes-malware-gateway-microsofts-xbox-plans-leak/)
- [TrueConf Server: Critical campaign with infected updates](https://www.secnews.gr/en/725958/trueconf-server-molysmeni-enimerosi/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1982