CISA KEV: Active Exploitation of TrueConf Server Vulnerabilities (CVE-2026-72529, CVE-2026-72530) by Head Mare APT

Key facts for TrueConf RCE head mare

Detection coverage for TrueConf RCE head mare

As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2087 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PhantomCore / PhantomGraph Post-Exploitation — Service Creation, COM Hijacking, LSASS Dumping

Detects Head Mare APT post-exploitation chain on TrueConf Server hosts: PhantomGraph Windows service creation (SysExcSvc, SysReadSvc), PhantomCore COM hijacking persistence via CLSID registry modification, and LSASS credential dumping via comsvcs.dll. Targets the three behavioral pillars of the post-exploitation phase: persistence, defense evasion, and credential access.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1543.003, T1546.015, T1003.001, T1112, T1059.001, T1027, T1036.005
• Data sources: sysmon, windows_security, windows_system, device_process_events, device_registry_events
• Severity: critical
• Confidence: high

Splunk SPL

index=windows sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational"
  (EventCode=1 OR EventCode=13 OR EventCode=11)
  | eval detection_signal = case(
      // PhantomGraph service creation via split Base64 PowerShell
      EventCode=1 AND Image="*\\powershell.exe"
        AND CommandLine LIKE "%New-Service%"
        AND (CommandLine LIKE "%SysExcSvc%" OR CommandLine LIKE "%SysReadSvc%"),
        "PHANTOMGRAPH_SERVICE_CREATE",
      // PhantomCore COM hijacking — CLSID registry modification
      EventCode=13 AND TargetObject="*\\0340F119-A598-4ed9-B0AC-6F6A12D3E755*\\InprocServer32*",
        "PHANTOMCORE_COM_HIJACK",
      // LSASS dumping via comsvcs.dll (rundll32 or direct)
      EventCode=11 AND TargetFilename="*\\lsass.exe"
        AND Image="*\\comsvcs.dll",
        "LSASS_DUMP_COMSVCS",
      // Suspicious service binary installation not matching known good
      EventCode=1 AND Image="*\\sc.exe"
        AND CommandLine LIKE "%create%"
        AND (CommandLine LIKE "%SysExcSvc%" OR CommandLine LIKE "%SysReadSvc%"
          OR CommandLine LIKE "%*.dll%"),
        "SUSPICIOUS_SERVICE_CREATE",
      1=1, null
    )
  | where isnotnull(detection_signal)
  | eval signature = case(
      CommandLine LIKE "%SysExcSvc%SysReadSvc%" OR CommandLine LIKE "%SysExcSvc.dll%"
        OR CommandLine LIKE "%SysReadSvc.dll%", "PHANTOMGRAPH",
      CommandLine LIKE "%PhantomCore%" OR detection_signal="PHANTOMCORE_COM_HIJACK", "PHANTOMCORE",
      1=1, "GENERIC_HEAD_MARE"
    )
  | stats count as alerts, values(CommandLine) as commands, values(Image) as processes
      by ComputerName, detection_signal, signature, User
  | sort - alerts
  | table _time, ComputerName, detection_signal, signature, commands, processes, User, alerts

Microsoft KQL

// PhantomCore / PhantomGraph Post-Exploitation Detection
// Covers service creation, COM hijacking, and LSASS dumping
let KnownMalServices = dynamic(["SysExcSvc", "SysReadSvc"]);
let ComHijackGuid = "0340F119-A598-4ed9-B0AC-6F6A12D3E755";
// Service creation events
(union isfuzzy=true
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "sc.exe")
| where ProcessCommandLine has_any (KnownMalServices)
| extend DetectionType = "PHANTOMGRAPH_SERVICE_CREATE"
| project Timestamp, DeviceName, DetectionType, ProcessCommandLine, AccountName
,
DeviceRegistryEvents
| where Timestamp > ago(30d)
| where RegistryKey contains ComHijackGuid
    and RegistryKey contains "InprocServer32"
| extend DetectionType = "PHANTOMCORE_COM_HIJACK"
| project Timestamp, DeviceName, DetectionType, RegistryKey, RegistryValueData, AccountName
,
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "rundll32.exe"
    and ProcessCommandLine contains "comsvcs.dll"
    and ProcessCommandLine has "lsass"
| extend DetectionType = "LSASS_DUMP_COMSVCS"
| project Timestamp, DeviceName, DetectionType, ProcessCommandLine, AccountName
)

Sigma

title: PhantomCore COM Hijacking Persistence — CLSID Registry Modification
id: b2d4f6a3-7c8e-4f1b-9d5a-e6f7a8b9c0d1
status: experimental
description: Detects COM hijacking registry modification associated with PhantomCore backdoor deployed by Head Mare APT. The CLSID key {0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 is created pointing to PhantomCore DLL for automatic persistence via COM object instantiation.
references:
    - https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/
    - https://attack.mitre.org/techniques/T1546/015/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-20
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.t1546.015
    - attack.t1112
    - attack.t1003.001
    - attack.t1543.003
    - attack.t1036.005
    - attack.t1027
    - attack.t1059.001
    - attack.tool.phantomcore
    - attack.tool.phantomgraph
logsource:
    category: registry_add
    product: windows
detection:
    selection:
        EventType: SetValue
        TargetObject|contains|all:
            - '0340F119-A598-4ed9-B0AC-6F6A12D3E755'
            - 'InprocServer32'
    filter_default:
        TargetObject|contains:
            - 'Microsoft\\Windows\\CurrentVersion\\Installer'
            - 'Microsoft\\Windows\\CurrentVersion\\Shell Extensions'
    condition: selection and not filter_default
detection_service:
    selection_service:
        EventID: 1
        Image|endswith: '\\sc.exe'
        CommandLine|contains|all:
            - 'create'
            - 'SysExcSvc'
    condition: selection_service
detection_lsass:
    selection_lsass:
        EventID: 11
        Image|contains: 'comsvcs.dll'
        TargetFilename|endswith: '\\lsass.exe'
    condition: selection_lsass
falsepositives:
    - Legitimate COM object registration by Windows Installer
    - Authorized system administration creating services with similar naming patterns
    - Legitimate minidump creation for troubleshooting
level: critical

Known false positives:

• Legitimate Windows service installations by system administrators
• Authorized COM object registrations for legitimate software
• Troubleshooting-related LSASS minidump creation

Tuning notes: Create exclusion for known-good service installations during change windows. Correlate service creation with the presence of non-digitally-signed DLLs for higher fidelity. PhantomGraph specifically uses Base64-encoded split PowerShell commands — monitor for fragmented PowerShell encoded command patterns combined with New-Service. The specific CLSID {0340F119-A598-4ed9-B0AC-6F6A12D3E755} should trigger immediate investigation on any TrueConf Server.

• 🔒 TrueConf Server CVE-2026-72529 Exploitation — Web Shell Deployment and Sandbox Escape · unlock with TL Creds
• 🔒 Head Mare PhantomCore PhantomGraph Post-Exploitation — COM Hijacking, Service Install, LSASS · unlock with TL Creds
• 🔒 PhantomGraph C2 — OneDrive Living-off-the-Cloud and BATCH File Execution · unlock with TL Creds
• 🔒 TrueConf Server Sandbox Escape — Service Process Spawning Shell — CVE-2026-72530 · unlock with TL Creds
• 🔒 Head Mare PhantomCore PhantomGraph — Supply Chain Trojan via TrueConf Client Installer · unlock with TL Creds
• 🔒 Head Mare PhantomGraph C2 — LSASS Dump and Host Reconnaissance via PhantomGraph Commands · unlock with TL Creds
• 🔒 TrueConf Server Unauthenticated Exploitation via Port 4307 — CVE-2026-72529 · unlock with TL Creds
• 🔒 Head Mare Reverse SSH Tunnel C2 and OneDrive Living-off-the-Cloud · unlock with TL Creds

Indicators of compromise for TrueConf RCE head mare

As of 2026-08-23, Threadlinqs Intelligence tracks 34 indicators of compromise for TL-2026-2087.

Sample indicators (3 of 34)

• IP address: 194.87.239[.]71
• Domain: bright-deals[.]site
• File hash: 4d27b4eb1c5dbb3d8160f29b8119523e

Defanged, TLP:CLEAR. Full set of 34 indicators: unlock with TL Creds.

How TrueConf RCE head mare works

On August 20, 2026, CISA added two critical vulnerabilities in TrueConf Server to the Known Exploited Vulnerabilities (KEV) catalog under BOD 26-04, requiring federal agencies to remediate by August 23, 2026 (CVE-2026-72529) and September 3, 2026 (CVE-2026-72530). Both vulnerabilities, discovered and reported by Kaspersky (internal IDs KLCERT-26-057 and KLCERT-26-058), are being actively exploited in the wild by the Head Mare APT group (also tracked as Rainbow Hyena).

Head Mare, previously classified as a hacktivist group but reclassified as APT-class due to sophisticated tradecraft and custom malware development, exclusively targets organizations in Russia and Belarus. Their victimology spans government, energy, transportation, electronics manufacturing, IT, software development, and instrumentation sectors.

The attack chain exploits both vulnerabilities in sequence. First, a remote unauthenticated attacker connects to the TrueConf Server's default TCP port 4307 and exploits CVE-2026-72529 (Missing Authentication for Critical Function; CWE-306) to invoke an undocumented function that transmits and executes a malicious script within TrueConf's isolated execution environment. Second, the attacker exploits CVE-2026-72530 (Code Injection / Sandbox Escape; CWE-94) to break out of the sandboxed environment and achieve arbitrary code execution as NT AUTHORITYSYSTEM on the underlying host.

With SYSTEM-level access, the attackers deploy a PHP web shell at \public\js\locale.php for persistent remote control. Through the web shell, they conduct IT infrastructure reconnaissance, access the TrueConf database, and replace legitimate TrueConf Client installer packages on the compromised server with trojanized, non-digitally-signed versions. Any organizational user who connects to the server receives the malicious installer through the legitimate update channel, creating a supply-chain infection path.

The trojanized installer delivers the PhantomCore backdoor, which achieves persistence via COM hijacking (HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32). PhantomCore performs system reconnaissance, LSASS memory dumping for credential theft (via comsvcs.dll), and deploys the PhantomGraph backdoor as the second stage.

PhantomGraph is a modular, two-DLL backdoor (SysExcSvc.dll and SysReadSvc.dll) installed as Windows services (SysExcSvc, SysReadSvc) via Base64-encoded PowerShell commands that were intentionally split to evade EDR detection. It uses a Microsoft OneDrive account as its command-and-control server, blending malicious traffic with legitimate cloud storage activity (living-off-the-cloud technique). PhantomGraph executes commands via BATCH files and has been observed performing LSASS memory dumps, executing host reconnaissance (hostname, whoami), and establishing reverse SSH tunnels to C2 infrastructure (194.87.239.71, 194.87.93.153).

TrueConf released patches on June 18, 2026 in versions 5.3.9, 5.4.9, and 5.5.5. The vulnerabilities affect TrueConf Server versions below 5.3.9, 5.4.x below 5.4.9, 5.5.x below 5.5.5, and all earlier versions. The long patch-to-exploitation window (June 18 to July 2026 detection) highlights the critical importance of rapid patch deployment for internet-exposed on-premises collaboration infrastructure.

A separate but related campaign, Operation TrueChaos (discovered by Check Point Research in March 2026), exploited CVE-2026-3502 — an unverified update RCE in TrueConf Client (versions 8.1.0 through 8.5.2) — to target Southeast Asian government entities. That campaign is attributed with moderate confidence to a Chinese-nexus threat actor and uses Havoc C2 infrastructure, distinct from Head Mare's operations. The convergence of both campaigns targeting TrueConf underscores the platform's strategic value as an attack vector for compromising organizational networks.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1003.001 OS Credential Dumping

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter; T1059.003 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204.002 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1611 Escape to Host

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer

defense-impairment

T1112 Modify Registry

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1195 Supply Chain Compromise

Persistence

T1505 Server Software Component; T1505.003 Server Software Component; T1543 Create or Modify System Process; T1543.003 Create or Modify System Process; T1546 Event Triggered Execution; T1546.015 Event Triggered Execution

command-and-control

T1572 Protocol Tunneling

Remediation for TrueConf RCE head mare

Patches

• TrueConf Server 5.5.5 (latest fully patched branch)
• TrueConf Server 5.4.9 (patched 5.4.x branch)
• TrueConf Server 5.3.9 (patched 5.3.x branch)
• TrueConf Client 8.5.3 (addresses separate CVE-2026-3502 update vulnerability)

Immediate actions

• Update TrueConf Server to version 5.5.5 (or 5.4.9 / 5.3.9 for older branches) immediately
• Restrict network access to TCP port 4307 to trusted hosts only — do not expose to the internet
• Verify all TrueConf Client installer distributions have valid digital signatures before deployment
• Isolate compromised servers and audit for web shell presence at \public\js\locale.php
• Check registry for COM hijacking key HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32

Workarounds

• Block TCP port 4307 at the network perimeter if TrueConf Server is not required externally
• Disable automatic client update distribution from compromised servers pending remediation
• Temporarily migrate to alternative video conferencing platforms until patches are verified

Longer-term hardening

• Implement network segmentation for on-premises collaboration infrastructure
• Deploy EDR with behavioral detection rules for LSASS dumping via comsvcs.dll
• Monitor for unauthorized Windows service creation (SysExcSvc, SysReadSvc)
• Audit Microsoft OneDrive activity for unauthorized API access patterns
• Implement file integrity monitoring for web server directories (public/js/)
• Conduct forensic review of any TrueConf client devices that connected to compromised servers

Affected and fixed versions

• TrueConf — TrueConf Server
  Vulnerable versions: <5.3.9; 5.3.x<5.3.9; 5.4.x<5.4.9; 5.5.x<5.5.5
  Fixed in: 5.3.9; 5.4.9; 5.5.5

Timeline of TrueConf RCE head mare

Last updated 2026-08-23 · 2 updates · revalidated 2× · latest source

• 2025-09-01 Earlier TrueConf vulnerabilities (BDU:2025-10114, BDU:2025-10115, BDU:2025-10116) abused since September 2025 to deliver PHP web shells and information-stealing payloads in separate campaigns
• 2026-03-01 Check Point Research reports CVE-2026-3502, a TrueConf zero-day exploited against Southeast Asian government entities to deploy Havoc C2 (Operation TrueChaos), tentatively attributed to a Chinese-nexus actor
• 2026-04-01 Positive Technologies discloses three TrueConf server vulnerabilities (BDU:2025-10114/10115/10116), showing sustained targeting of the platform
• 2026-06-18 TrueConf releases security patches for both vulnerabilities in versions 5.3.9, 5.4.9, and 5.5.5
• 2026-07 Kaspersky detects Head Mare APT group exploiting unpatched TrueConf Servers in the wild, deploying PhantomCore and PhantomGraph backdoors via trojanized client installers
• 2026-08-07 Kaspersky ICS-CERT publishes technical advisories KLCERT-26-057 and KLCERT-26-058 detailing both vulnerabilities
• 2026-08-08 BleepingComputer publishes detailed report on the Head Mare TrueConf campaign describing full attack chain, web shell deployment, and supply-chain installer compromise
• 2026-08-12 Kaspersky SecureList publishes a comprehensive threat report linking TrueConf exploitation to Head Mare and documenting PhantomCore/PhantomGraph with full IOCs and YARA rules, including a previously-undocumented Linux/ELF variant of the campaign (PhantomHook, PhantomReact) using GitHub as C2
• 2026-08-19 Kaspersky publishes CVE-2026-72529 (Missing Authentication, CVSS 9.8) and CVE-2026-72530 (Code Injection / Sandbox Escape, CVSS 9.0) for the TrueConf Server vulnerabilities
• 2026-08-20 CISA adds both vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog under BOD 26-04 directive, requiring federal agency remediation
• 2026-08-21 The Register reports on the CISA KEV addition, noting federal agencies ordered to patch TrueConf Server
• 2026-08-23 CISA BOD 26-04 remediation due date for CVE-2026-72529 (Missing Authentication) — federal agencies must patch or discontinue use
• 2026-09-03 CISA BOD 26-04 remediation due date for CVE-2026-72530 (Code Injection / Sandbox Escape)
• 2026-09-10 Broader CISA federal deadline (BOD 22-01 / BOD 26-04 guidance) for US federal agencies to apply patches

Update history

• 2026-08-23 — CISA Orders Federal Agencies to Patch Actively Exploited TrueConf Server Flaws (CVE-2026-72529, CVE-2026-72530): What changed No field-level escalation: severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), and CVSS (9.8) are unchanged and already at maximum. The newer report proposes a lower attribution_confidence (MEDIUM vs. existing HIGH)
• 2026-08-21 — Active Exploitation of TrueConf Server Vulnerabilities (CVE-2026-72529, CVE-2026-72530) by Head Mare APT Group Delivering PhantomCore Backdoor via Trojanized Installers: What changed No field escalations — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), CVSS (9.8), and attribution confidence (HIGH) are unchanged. The update is additive: it reveals a Linux/ELF arm of the same campaign (Phantom

Sources cited for TrueConf RCE head mare

• CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA · Government advisory · 2026-08-20
• Head Mare targets TrueConf Server with PhantomCore and PhantomGraph backdoors Kaspersky Securelist · Research
• TrueConf Security Advisory — Vulnerability Catalog trueconf.com · Vendor report · 2026-06-18
• Operation TrueChaos: Zero-day exploitation against Southeast Asian government targets Check Point Research · Research · 2026-03-31
• Organizations face new attacks via unpatched TrueConf videoconferencing servers Kaspersky · Vendor report
• Head Mare hacktivists — Securelist report (2024) Kaspersky Securelist · Research
• TrueConf Server Security Documentation trueconf.com · Vendor report
• Check Point Blog: When trusted software updates become the attack vector Check Point · Blog · 2026-03-31
• Hackers breach TrueConf to trojanize client installers with backdoors BleepingComputer · News · 2026-08-08

Threats related to TrueConf RCE head mare

• Head Mare APT Exploits Unpatched TrueConf Server Flaws to Deploy PhantomCore and PhantomGraph Backdoors
• Head Mare Breaches TrueConf Servers to Trojanize Client Installers with PhantomCore/PhantomGraph Backdoors

More from Head Mare

• APT and Financial Attacks on Industrial Organizations in Q1 2026 (Kaspersky ICS CERT): Operation Neusploit (CVE-2026-21509/CVE-2026-21513), Poland Energy Wipers, TGR-STA-1030, MuddyWater, LockBit 5.0, Diesel Vortex

Previous and next in vulnerability

• Gogs Critical RCE via Path Traversal in Organization Names (CVE-2026-52813) Next report