# CISA KEV: Active Exploitation of TrueConf Server Vulnerabilities (CVE-2026-72529, CVE-2026-72530) by Head Mare APT

> CISA added two TrueConf Server vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog on August 20, 2026 based on confirmed active exploitation. CVE-2026-72529 (CVSS 9.8, Missing Authentication) and CVE-2026-72530 (CVSS 9.0, Sandbox Escape / Code Injection) are chained by the pro-Ukraine Head Mare APT group to achieve unauthenticated remote code execution at SYSTEM level on TCP port 4307, leading to web shell deployment, database access, and supply-chain compromise via trojanized TrueConf Client installers carrying PhantomCore and PhantomGraph backdoors.

- **Published:** 2026-08-20T00:00:00Z
- **Last reviewed:** 2026-08-23T05:58:07.723Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2087
- **ID:** TL-2026-2087
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Head Mare (Ukraine)
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-72529, CVE-2026-72530

## Description

On August 20, 2026, CISA added two critical vulnerabilities in TrueConf Server to the Known Exploited Vulnerabilities (KEV) catalog under BOD 26-04, requiring federal agencies to remediate by August 23, 2026 (CVE-2026-72529) and September 3, 2026 (CVE-2026-72530). Both vulnerabilities, discovered and reported by Kaspersky (internal IDs KLCERT-26-057 and KLCERT-26-058), are being actively exploited in the wild by the Head Mare APT group (also tracked as Rainbow Hyena).

Head Mare, previously classified as a hacktivist group but reclassified as APT-class due to sophisticated tradecraft and custom malware development, exclusively targets organizations in Russia and Belarus. Their victimology spans government, energy, transportation, electronics manufacturing, IT, software development, and instrumentation sectors.

The attack chain exploits both vulnerabilities in sequence. First, a remote unauthenticated attacker connects to the TrueConf Server's default TCP port 4307 and exploits CVE-2026-72529 (Missing Authentication for Critical Function; CWE-306) to invoke an undocumented function that transmits and executes a malicious script within TrueConf's isolated execution environment. Second, the attacker exploits CVE-2026-72530 (Code Injection / Sandbox Escape; CWE-94) to break out of the sandboxed environment and achieve arbitrary code execution as NT AUTHORITYSYSTEM on the underlying host.

With SYSTEM-level access, the attackers deploy a PHP web shell at \public\js\locale.php for persistent remote control. Through the web shell, they conduct IT infrastructure reconnaissance, access the TrueConf database, and replace legitimate TrueConf Client installer packages on the compromised server with trojanized, non-digitally-signed versions. Any organizational user who connects to the server receives the malicious installer through the legitimate update channel, creating a supply-chain infection path.

The trojanized installer delivers the PhantomCore backdoor, which achieves persistence via COM hijacking (HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32). PhantomCore performs system reconnaissance, LSASS memory dumping for credential theft (via comsvcs.dll), and deploys the PhantomGraph backdoor as the second stage.

PhantomGraph is a modular, two-DLL backdoor (SysExcSvc.dll and SysReadSvc.dll) installed as Windows services (SysExcSvc, SysReadSvc) via Base64-encoded PowerShell commands that were intentionally split to evade EDR detection. It uses a Microsoft OneDrive account as its command-and-control server, blending malicious traffic with legitimate cloud storage activity (living-off-the-cloud technique). PhantomGraph executes commands via BATCH files and has been observed performing LSASS memory dumps, executing host reconnaissance (hostname, whoami), and establishing reverse SSH tunnels to C2 infrastructure (194.87.239.71, 194.87.93.153).

TrueConf released patches on June 18, 2026 in versions 5.3.9, 5.4.9, and 5.5.5. The vulnerabilities affect TrueConf Server versions below 5.3.9, 5.4.x below 5.4.9, 5.5.x below 5.5.5, and all earlier versions. The long patch-to-exploitation window (June 18 to July 2026 detection) highlights the critical importance of rapid patch deployment for internet-exposed on-premises collaboration infrastructure.

A separate but related campaign, Operation TrueChaos (discovered by Check Point Research in March 2026), exploited CVE-2026-3502 — an unverified update RCE in TrueConf Client (versions 8.1.0 through 8.5.2) — to target Southeast Asian government entities. That campaign is attributed with moderate confidence to a Chinese-nexus threat actor and uses Havoc C2 infrastructure, distinct from Head Mare's operations. The convergence of both campaigns targeting TrueConf underscores the platform's strategic value as an attack vector for compromising organizational networks.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1505 Server Software Component
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1572 Protocol Tunneling
- T1005 Data from Local System
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1071 Application Layer Protocol
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1195 Supply Chain Compromise
- T1611 Escape to Host
- T1204.002 User Execution
- T1105 Ingress Tool Transfer
- T1003.001 OS Credential Dumping
- T1546.015 Event Triggered Execution
- T1543.003 Create or Modify System Process
- T1505.003 Server Software Component
- T1059.001 Command and Scripting Interpreter
- T1059.003 Command and Scripting Interpreter

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [Head Mare targets TrueConf Server with PhantomCore and PhantomGraph backdoors](https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/)
- [Hackers breach TrueConf to trojanize client installers with backdoors](https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/)
- [TrueConf Security Advisory — Vulnerability Catalog](https://trueconf.com/blog/news/security-fixes-updates-and-advisories)
- [Operation TrueChaos: Zero-day exploitation against Southeast Asian government targets](https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/)
- [Organizations face new attacks via unpatched TrueConf videoconferencing servers](https://me-en.kaspersky.com/about/press-releases/organizations-face-new-attacks-via-unpatched-trueconf-videoconferencing-servers-kaspersky-warns)
- [Head Mare hacktivists — Securelist report (2024)](https://securelist.com/head-mare-hacktivists/113555/)
- [Check Point Blog: When trusted software updates become the attack vector](https://blog.checkpoint.com/research/when-trusted-software-updates-become-the-attack-vector-inside-operation-truechaos-and-a-new-zero-day-vulnerability-in-a-popular-collaboration-tool/)
- [TrueConf Server Security Documentation](https://trueconf.com/docs/server/en/admin/server-part/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2087