CISA KEV: Active Exploitation of TrueConf Server Vulnerabilities (CVE-2026-72529, CVE-2026-72530) by Head Mare APT
CISA KEV: Active Exploitation of TrueConf Server (TL-2026-2087) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-08-20 and last reviewed 2026-08-23. It is attributed to Head Mare (Ukraine) with high confidence, affects TrueConf TrueConf Server, references 2 CVEs (CVE-2026-72529, CVE-2026-72530), maps to 28 MITRE ATT&CK techniques (T1003, T1003.001, T1005), and is covered by 9 detection rules and 34 indicators of compromise.
Key facts for TL-2026-2087
- Threat ID
- TL-2026-2087
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-20
- Last reviewed
- 2026-08-23
- Attribution
- Head Mare
- Attribution confidence
- HIGH
- Nation-state nexus
- Ukraine
- Motivation
- ESPIONAGE
- Target sectors
- government administration, energy, transport, electronics-manufacturing, information-technology, software-development, instrumentation
- Target regions
- russia, belarus
- Detection rules
- 9
- Indicators of compromise
- 34
- Updates
- 2026-08-23 · 2 updates · revalidated 2× · latest source
Malware and tooling in CISA KEV: Active Exploitation of TrueConf Server
Malware and tooling: PhantomCore
CISA added two TrueConf Server vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog on August 20, 2026 based on confirmed active exploitation. CVE-2026-72529 (CVSS 9.8, Missing Authentication) and CVE-2026-72530 (CVSS 9.0, Sandbox Escape / Code Injection) are chained by the pro-Ukraine Head Mare APT group to achieve unauthenticated remote code execution at SYSTEM level on TCP port 4307, leading to web shell deployment, database access, and supply-chain compromise via trojanized TrueConf Client installers carrying PhantomCore and PhantomGraph backdoors.
How CISA KEV: Active Exploitation of TrueConf Server works
On August 20, 2026, CISA added two critical vulnerabilities in TrueConf Server to the Known Exploited Vulnerabilities (KEV) catalog under BOD 26-04, requiring federal agencies to remediate by August 23, 2026 (CVE-2026-72529) and September 3, 2026 (CVE-2026-72530). Both vulnerabilities, discovered and reported by Kaspersky (internal IDs KLCERT-26-057 and KLCERT-26-058), are being actively exploited in the wild by the Head Mare APT group (also tracked as Rainbow Hyena).
Head Mare, previously classified as a hacktivist group but reclassified as APT-class due to sophisticated tradecraft and custom malware development, exclusively targets organizations in Russia and Belarus. Their victimology spans government, energy, transportation, electronics manufacturing, IT, software development, and instrumentation sectors.
The attack chain exploits both vulnerabilities in sequence. First, a remote unauthenticated attacker connects to the TrueConf Server's default TCP port 4307 and exploits CVE-2026-72529 (Missing Authentication for Critical Function; CWE-306) to invoke an undocumented function that transmits and executes a malicious script within TrueConf's isolated execution environment. Second, the attacker exploits CVE-2026-72530 (Code Injection / Sandbox Escape; CWE-94) to break out of the sandboxed environment and achieve arbitrary code execution as NT AUTHORITYSYSTEM on the underlying host.
With SYSTEM-level access, the attackers deploy a PHP web shell at \public\js\locale.php for persistent remote control. Through the web shell, they conduct IT infrastructure reconnaissance, access the TrueConf database, and replace legitimate TrueConf Client installer packages on the compromised server with trojanized, non-digitally-signed versions. Any organizational user who connects to the server receives the malicious installer through the legitimate update channel, creating a supply-chain infection path.
The trojanized installer delivers the PhantomCore backdoor, which achieves persistence via COM hijacking (HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32). PhantomCore performs system reconnaissance, LSASS memory dumping for credential theft (via comsvcs.dll), and deploys the PhantomGraph backdoor as the second stage.
PhantomGraph is a modular, two-DLL backdoor (SysExcSvc.dll and SysReadSvc.dll) installed as Windows services (SysExcSvc, SysReadSvc) via Base64-encoded PowerShell commands that were intentionally split to evade EDR detection. It uses a Microsoft OneDrive account as its command-and-control server, blending malicious traffic with legitimate cloud storage activity (living-off-the-cloud technique). PhantomGraph executes commands via BATCH files and has been observed performing LSASS memory dumps, executing host reconnaissance (hostname, whoami), and establishing reverse SSH tunnels to C2 infrastructure (194.87.239.71, 194.87.93.153).
TrueConf released patches on June 18, 2026 in versions 5.3.9, 5.4.9, and 5.5.5. The vulnerabilities affect TrueConf Server versions below 5.3.9, 5.4.x below 5.4.9, 5.5.x below 5.5.5, and all earlier versions. The long patch-to-exploitation window (June 18 to July 2026 detection) highlights the critical importance of rapid patch deployment for internet-exposed on-premises collaboration infrastructure.
A separate but related campaign, Operation TrueChaos (discovered by Check Point Research in March 2026), exploited CVE-2026-3502 — an unverified update RCE in TrueConf Client (versions 8.1.0 through 8.5.2) — to target Southeast Asian government entities. That campaign is attributed with moderate confidence to a Chinese-nexus threat actor and uses Havoc C2 infrastructure, distinct from Head Mare's operations. The convergence of both campaigns targeting TrueConf underscores the platform's strategic value as an attack vector for compromising organizational networks.
MITRE ATT&CK techniques used in TL-2026-2087
Credential Access
T1003 OS Credential Dumping; T1003.001 OS Credential Dumping
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter; T1059.003 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204.002 User Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer
defense-impairment
Initial Access
T1190 Exploit Public-Facing Application
Impact
Persistence
T1505 Server Software Component; T1505.003 Server Software Component; T1543 Create or Modify System Process; T1543.003 Create or Modify System Process; T1546 Event Triggered Execution; T1546.015 Event Triggered Execution
command-and-control
Affected products and versions in CISA KEV: Active Exploitation of TrueConf Server
- TrueConf — TrueConf Server
Vulnerable versions: <5.3.9; 5.3.x<5.3.9; 5.4.x<5.4.9; 5.5.x<5.5.5
Fixed in: 5.3.9; 5.4.9; 5.5.5
Remediation for CISA KEV: Active Exploitation of TrueConf Server
Patches
- TrueConf Server 5.5.5 (latest fully patched branch)
- TrueConf Server 5.4.9 (patched 5.4.x branch)
- TrueConf Server 5.3.9 (patched 5.3.x branch)
- TrueConf Client 8.5.3 (addresses separate CVE-2026-3502 update vulnerability)
Immediate actions
- Update TrueConf Server to version 5.5.5 (or 5.4.9 / 5.3.9 for older branches) immediately
- Restrict network access to TCP port 4307 to trusted hosts only — do not expose to the internet
- Verify all TrueConf Client installer distributions have valid digital signatures before deployment
- Isolate compromised servers and audit for web shell presence at \public\js\locale.php
- Check registry for COM hijacking key HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32
Workarounds
- Block TCP port 4307 at the network perimeter if TrueConf Server is not required externally
- Disable automatic client update distribution from compromised servers pending remediation
- Temporarily migrate to alternative video conferencing platforms until patches are verified
Longer-term hardening
- Implement network segmentation for on-premises collaboration infrastructure
- Deploy EDR with behavioral detection rules for LSASS dumping via comsvcs.dll
- Monitor for unauthorized Windows service creation (SysExcSvc, SysReadSvc)
- Audit Microsoft OneDrive activity for unauthorized API access patterns
- Implement file integrity monitoring for web server directories (public/js/)
- Conduct forensic review of any TrueConf client devices that connected to compromised servers
CVEs associated with CISA KEV: Active Exploitation of TrueConf Server
CVE-2026-72529, CVE-2026-72530
Weaknesses (CWE) in CISA KEV: Active Exploitation of TrueConf Server
CWE-306, CWE-94, CWE-285
Timeline of CISA KEV: Active Exploitation of TrueConf Server
- Earlier TrueConf vulnerabilities (BDU:2025-10114, BDU:2025-10115, BDU:2025-10116) abused since September 2025 to deliver PHP web shells and information-stealing payloads in separate campaigns
- Check Point Research reports CVE-2026-3502, a TrueConf zero-day exploited against Southeast Asian government entities to deploy Havoc C2 (Operation TrueChaos), tentatively attributed to a Chinese-nexus actor
- Positive Technologies discloses three TrueConf server vulnerabilities (BDU:2025-10114/10115/10116), showing sustained targeting of the platform
- TrueConf releases security patches for both vulnerabilities in versions 5.3.9, 5.4.9, and 5.5.5
- Kaspersky detects Head Mare APT group exploiting unpatched TrueConf Servers in the wild, deploying PhantomCore and PhantomGraph backdoors via trojanized client installers
- Kaspersky ICS-CERT publishes technical advisories KLCERT-26-057 and KLCERT-26-058 detailing both vulnerabilities
- BleepingComputer publishes detailed report on the Head Mare TrueConf campaign describing full attack chain, web shell deployment, and supply-chain installer compromise
- Kaspersky SecureList publishes a comprehensive threat report linking TrueConf exploitation to Head Mare and documenting PhantomCore/PhantomGraph with full IOCs and YARA rules, including a previously-undocumented Linux/ELF variant of the campaign (PhantomHook, PhantomReact) using GitHub as C2
- Kaspersky publishes CVE-2026-72529 (Missing Authentication, CVSS 9.8) and CVE-2026-72530 (Code Injection / Sandbox Escape, CVSS 9.0) for the TrueConf Server vulnerabilities
- CISA adds both vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog under BOD 26-04 directive, requiring federal agency remediation
- The Register reports on the CISA KEV addition, noting federal agencies ordered to patch TrueConf Server
- CISA BOD 26-04 remediation due date for CVE-2026-72529 (Missing Authentication) — federal agencies must patch or discontinue use
- CISA BOD 26-04 remediation due date for CVE-2026-72530 (Code Injection / Sandbox Escape)
- Broader CISA federal deadline (BOD 22-01 / BOD 26-04 guidance) for US federal agencies to apply patches
Update history for TL-2026-2087
- 2026-08-23 — CISA Orders Federal Agencies to Patch Actively Exploited TrueConf Server Flaws (CVE-2026-72529, CVE-2026-72530): What changed No field-level escalation: severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), and CVSS (9.8) are unchanged and already at maximum. The newer report proposes a lower attribution_confidence (MEDIUM vs. existing HIGH)
- 2026-08-21 — Active Exploitation of TrueConf Server Vulnerabilities (CVE-2026-72529, CVE-2026-72530) by Head Mare APT Group Delivering PhantomCore Backdoor via Trojanized Installers: What changed No field escalations — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), CVSS (9.8), and attribution confidence (HIGH) are unchanged. The update is additive: it reveals a Linux/ELF arm of the same campaign (Phantom
Sources cited for CISA KEV: Active Exploitation of TrueConf Server
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- Head Mare targets TrueConf Server with PhantomCore and PhantomGraph backdoors
- Hackers breach TrueConf to trojanize client installers with backdoors
- TrueConf Security Advisory — Vulnerability Catalog
- Operation TrueChaos: Zero-day exploitation against Southeast Asian government targets
- Organizations face new attacks via unpatched TrueConf videoconferencing servers
- Head Mare hacktivists — Securelist report (2024)
- Check Point Blog: When trusted software updates become the attack vector
- TrueConf Server Security Documentation
Threats related to CISA KEV: Active Exploitation of TrueConf Server
Detection coverage for TL-2026-2087
As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2087 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.