Listen to this Post
Introduction: When the Meeting Room Becomes the Attack Surface
Video conferencing has become part of the basic infrastructure of modern organizations. What was once simply a convenient way to hold meetings is now deeply connected to corporate networks, government communications, internal collaboration, file sharing, authentication systems, and software distribution. That makes a compromised conferencing server far more dangerous than a compromised meeting application alone.
A new campaign attributed to the hacktivist group Head Mare demonstrates exactly how dangerous that trust can become. According to research from Kaspersky, attackers have been exploiting vulnerabilities in unpatched TrueConf Server installations to gain powerful access to vulnerable systems, establish persistence, steal sensitive information, and even replace legitimate TrueConf client installers with malicious versions.
The most disturbing part is that victims do not necessarily need to operate the compromised server themselves. Employees can potentially become infected simply by connecting to a compromised TrueConf server belonging to a business partner or other organization and downloading what appears to be a legitimate software update.
This turns a trusted collaboration platform into something much more dangerous: a potential software-distribution mechanism for malware.
The Attack in Brief
Kaspersky researchers discovered the activity in July 2026 while investigating attacks against Russian organizations. The attackers exploited vulnerabilities in older versions of TrueConf Server that allowed them to execute code inside the application’s environment and subsequently escape that environment to reach the underlying operating system.
Once administrative control was established, Head Mare deployed two malware families known as PhantomCore and PhantomGraph.
The attackers also modified a TrueConf file and used it as a web shell, giving them persistent remote access to the compromised server.
From there, the campaign moved beyond simple server compromise. The attackers accessed the TrueConf database, gathered information about the victim’s environment, and replaced the legitimate TrueConf Client installer with a malicious version containing the PhantomCore backdoor.
That creates a particularly dangerous supply-chain scenario.
Why TrueConf Is Such an Attractive Target
TrueConf is widely used in Russia, particularly among enterprise and government organizations. It is positioned as an on-premises video conferencing solution and has been used as an alternative to Western platforms such as Zoom and Microsoft Teams.
An on-premises deployment can offer organizations greater control over their communications infrastructure. But that control also creates responsibility.
When a company hosts its own collaboration server, the server becomes part of its security perimeter. It must be patched, monitored, isolated, hardened, and continuously tested.
If an organization leaves such infrastructure exposed and unpatched, attackers may not need to compromise individual employees first. They can attack the platform that employees already trust.
The First Door: TCP Port 4307
One of the technical details that makes this campaign especially concerning is the attackers’ use of TCP port 4307.
According to Kaspersky, the port is open by default on TrueConf installations and allowed Head Mare to communicate with targeted servers without authentication.
An exposed service does not automatically mean that a server is compromised. However, every externally reachable service increases the potential attack surface, particularly when vulnerabilities exist in the application behind it.
The lesson is simple: organizations should know exactly which services are exposed to the internet and why they need to be exposed.
KLCERT-26-057: Breaking Into the Application Environment
The attackers reportedly exploited a vulnerability tracked by Kaspersky as KLCERT-26-057.
The flaw enabled the threat actor to execute a malicious script inside TrueConf’s isolated environment.
Application isolation is designed to prevent exactly this type of escalation. Even if an attacker manages to execute code within an application, the security boundary should theoretically prevent that code from freely interacting with the underlying operating system.
But the attackers had another step.
KLCERT-26-058: Escaping the Sandbox
The second vulnerability, tracked as KLCERT-26-058, reportedly allowed the attackers to escape TrueConf’s isolated environment and execute commands on the underlying operating system.
This is where the intrusion became substantially more serious.
A vulnerability that permits code execution inside an application can already be dangerous. A vulnerability that allows attackers to cross the application’s isolation boundary can transform that weakness into full system compromise.
Head Mare used the two vulnerabilities together rather than treating them as isolated bugs.
From Application Access to SYSTEM Privileges
After reaching the underlying operating system, the attackers escalated their privileges to NT AUTHORITY\SYSTEM.
On Windows, SYSTEM represents one of the highest levels of local privilege. An attacker operating with these privileges can perform actions far beyond those available to a normal user.
This dramatically expands what can be done after the initial compromise.
Instead of simply manipulating the TrueConf application, attackers can potentially inspect the host, access sensitive files, establish persistence, interact with security mechanisms, deploy additional malware, and use the compromised machine as a launch point for attacks against other systems.
The Web Shell That Kept the Door Open
Head Mare reportedly replaced the \public\js\locale.php file with a malicious web shell.
The significance of this modification goes beyond the fact that a legitimate application file was altered.
A web shell provides attackers with a mechanism for remotely interacting with a compromised server through web requests. If it survives updates or remains undetected, it can provide persistent access even after the initial vulnerability is no longer exploitable.
This is why defenders should not limit their response to simply installing a patch.
Once exploitation has occurred, organizations need to determine whether the attacker established persistence and whether legitimate application files were modified.
PhantomCore: Turning Software Updates Into a Weapon
One of the most dangerous elements of the campaign is the deployment of PhantomCore.
According to Kaspersky, Head Mare used its access to replace the legitimate TrueConf Client installer hosted on the compromised server with a malicious installer containing the PhantomCore backdoor.
This is a classic example of why software trust relationships can become dangerous.
Employees normally assume that an update delivered through an organization’s official infrastructure is safe. They may not inspect the installer manually, verify its cryptographic signature, or question why the software is being offered by an internal server.
The attacker exploits that assumption.
The Victim Does Not Have to Own the Compromised Server
Perhaps the most important warning from this campaign is that an organization does not necessarily need to operate a compromised TrueConf server to become exposed.
Imagine a company working with a contractor.
The contractor operates its own TrueConf server.
Employees from the first company connect to that server for meetings.
The
The attackers replace the legitimate client installer.
An employee downloads the malicious package.
The compromise can now move from one organization to another.
This is precisely why modern cybersecurity increasingly focuses on third-party risk and software supply-chain security rather than treating every organization as an isolated environment.
PhantomGraph: A Second Backdoor With a Different Role
Head Mare also deploys another backdoor called PhantomGraph.
Kaspersky describes PhantomGraph as consisting of two DLL files:
SysExcSvc.dll
SysReadSvc.dll
The malware reportedly uses a Microsoft OneDrive account as a command-and-control mechanism. Commands can be retrieved, executed, and followed by the return of results.
Using legitimate cloud infrastructure for command communication can make malicious activity more difficult to distinguish from ordinary network traffic.
This is one reason modern defenders cannot rely exclusively on simplistic indicators such as unusual IP addresses.
Credential Theft Through LSASS
One particularly serious activity observed through PhantomGraph was the dumping of the memory of the Local Security Authority Subsystem Service (LSASS) process.
LSASS is a highly sensitive Windows component involved in authentication and credential management.
Memory extraction from LSASS has historically been a major objective for attackers because credentials or authentication material may be exposed depending on the system configuration and security controls.
If successful, credential theft can transform a single compromised server into a stepping stone toward additional accounts, systems, and network resources.
Reconnaissance Before Expansion
The attackers did not simply deploy malware and disappear.
Observed commands reportedly included basic reconnaissance such as:
hostname
whoami
These commands may look primitive, but they are extremely useful to an attacker.
hostname can identify the machine.
whoami can reveal the current security context.
Together with additional reconnaissance, such commands help an attacker understand where they are, what privileges they possess, and what opportunities exist for further movement.
Cyberattacks often begin with simple questions:
Where am I?
Who am I?
What can I access?
Where can I go next?
Reverse SSH Tunneling Adds Another Layer
PhantomGraph was also observed starting a reverse SSH tunnel.
Reverse tunneling can provide attackers with a communication path from an internal environment outward to infrastructure they control.
This can be particularly useful when inbound connections are restricted by firewalls or network segmentation.
Rather than trying to connect directly into a protected organization, the attacker can abuse an already compromised internal system to establish an outbound communication channel.
Head Mare Is Targeting Multiple Industries
Kaspersky reported that multiple Head Mare campaigns are currently targeting Russian organizations across a variety of sectors.
Targets reportedly include:
Instrumentation
Electronics
Transportation
Energy
Information technology
Software development
The diversity of these targets suggests that the campaign is not narrowly focused on one industry.
Instead, the attackers appear interested in organizations where valuable infrastructure, intellectual property, credentials, business information, or access to additional partners can be obtained.
Initial Access Is Not Limited to TrueConf
The TrueConf vulnerabilities represent an important part of the campaign, but Kaspersky reportedly observed Head Mare using several initial-access techniques.
These include phishing.
They also include exploitation of public-facing web servers.
Another route involves access obtained through contractors.
This combination is significant because it demonstrates that sophisticated campaigns rarely depend on a single vulnerability.
If one entrance is closed, attackers can search for another.
The Wider TrueConf Security Picture
The current campaign is not the first major security incident involving TrueConf.
In April 2026, Check Point Research reported attacks exploiting a zero-day arbitrary file execution vulnerability in TrueConf, tracked as CVE-2026-3502.
That campaign was called Operation True Chaos by Check Point Research and was tentatively linked to Chinese threat actors associated with the Havoc implant.
Those attacks also reportedly involved trojanized client updates.
The repeated appearance of malicious software distribution through TrueConf infrastructure is therefore an important warning sign.
The Critical Versions
The vulnerabilities exploited in the latest campaign affect several older TrueConf Server branches.
Affected versions include:
TrueConf Server 5.3.x before 5.3.9
TrueConf Server 5.4.x before 5.4.9
TrueConf Server 5.5.x before 5.5.5
Older versions are also affected.
TrueConf released fixes for the affected branches on June 18, 2026, including versions 5.3.9, 5.4.9, and 5.5.5.
Organizations still running older releases should treat upgrading as a priority rather than a routine maintenance task.
Patching Is Necessary — But It Is Not Enough
Installing the fixed version closes the known vulnerability.
It does not automatically remove an attacker who has already gained access.
If exploitation occurred before the patch was installed, defenders must investigate the possibility of:
Web shells
Modified application files
Unauthorized accounts
New scheduled tasks
Suspicious services
Malware DLLs
Credential theft
Unexpected outbound connections
Persistence mechanisms
Lateral movement
A patched but previously compromised server can still be dangerous.
Deep Analysis: How Defenders Can Investigate
Security teams should begin by establishing the exact TrueConf version running on every server.
On Windows systems, administrators can inventory installed software and inspect suspicious services using commands such as:
Get-Service | Sort-Object Status, Name
Administrators can review listening ports with:
Get-NetTCPConnection -State Listen | Sort-Object LocalPort | Format-Table LocalAddress,LocalPort,OwningProcess
To investigate the process associated with a suspicious port:
Get-NetTCPConnection -LocalPort 4307 | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
Then identify the process:
Get-Process -Id <PID>
Replace
Deep Analysis: Check Application Integrity
Because the campaign reportedly modified a TrueConf application file, defenders should compare important application files against trusted copies.
For example:
Get-FileHash "C:\Path\To\public\js\locale.php" -Algorithm SHA256
The resulting hash should be compared with a verified clean version.
Organizations should also examine modification timestamps:
Get-Item "C:\Path\To\public\js\locale.php" | Select-Object FullName,Length,CreationTime,LastWriteTime
A recently modified application file on a server that was not recently updated deserves immediate investigation.
Deep Analysis: Search for Suspicious Persistence
Security teams should review Windows services:
Get-CimInstance Win32_Service | Select-Object Name,State,StartMode,StartName,PathName
They should also inspect scheduled tasks:
Get-ScheduledTask | Select-Object TaskName,TaskPath,State
Unexpected services or scheduled tasks created around the suspected intrusion period can provide valuable evidence.
Deep Analysis: Investigate Outbound Connections
Defenders should also examine outbound network activity from the TrueConf server.
A useful starting point is:
Get-NetTCPConnection |
Where-Object {$_.State -eq "Established"} |
Sort-Object RemoteAddress |
Format-Table LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess
The goal is not to assume that every unusual connection is malicious.
Instead, investigators should establish which connections are expected, which belong to legitimate services, and which appeared only after the suspected compromise.
Deep Analysis: Protect Against Credential Theft
Because LSASS memory dumping was reportedly observed, organizations should treat credential exposure as a serious possibility following a confirmed compromise.
Potentially affected credentials should be rotated according to the organization’s incident-response procedures.
Privileged accounts should receive particular attention.
Security teams should also review authentication logs for unusual logins, privilege escalation, lateral movement, and access from unexpected hosts.
Deep Analysis: Examine Software Distribution
The most important investigative question may be:
Did the compromised TrueConf server distribute a malicious installer?
Organizations should determine:
Which users downloaded the TrueConf client?
Which installer versions were distributed?
When were downloads performed?
Were installers digitally signed?
Did file hashes change unexpectedly?
Did endpoints execute suspicious child processes afterward?
Did any endpoint establish connections associated with PhantomCore or PhantomGraph?
This investigation should extend to third-party organizations if employees regularly connect to external TrueConf servers.
Deep Analysis: Verify Digital Signatures
A legitimate installer should normally be evaluated for authenticity before deployment.
Administrators can inspect a Windows
Get-AuthenticodeSignature "C:\Path\To\TrueConfClient.exe"
A result showing an invalid, missing, or unexpected signature should trigger investigation.
However, signature verification should be treated as one security layer rather than the only defense.
Deep Analysis: Use EDR Instead of Trusting the Application
Endpoint Detection and Response platforms should be configured to identify suspicious behavior rather than merely known malware names.
Potential signals include:
An installer spawning PowerShell unexpectedly
A video-conferencing client launching command shells
Unexpected DLL loading
Credential-dumping behavior
Reverse SSH activity
Abnormal child processes
Unusual persistence mechanisms
Suspicious access to LSASS
Unexpected cloud-based command-and-control traffic
Behavioral detection becomes especially important when attackers modify legitimate software.
Deep Analysis: Segment Collaboration Infrastructure
A video conferencing server should not have unrestricted access to the entire corporate environment.
Network segmentation can limit the consequences of compromise.
Organizations should consider placing externally reachable collaboration infrastructure into appropriately isolated network zones and restricting communication to only the systems that genuinely require it.
The objective is simple:
Compromise one server without allowing the attacker to inherit the entire network.
What Undercode Say:
1. The Real Weapon Is Trust
The most dangerous component of this campaign may not be PhantomCore itself.
It is trust.
2. Employees Trust Internal Software
Users naturally assume that software delivered through a corporate platform is legitimate.
3. Partners Create Invisible Attack Paths
A compromised contractor can become a bridge into another organization’s environment.
4. Collaboration Platforms Are Becoming Security-Critical
Video conferencing servers are no longer ordinary communication tools.
5. On-Premises Means More Responsibility
Owning the infrastructure gives an organization more control, but also more security obligations.
6. Default Services Deserve Scrutiny
A service being enabled by default does not mean it should remain publicly accessible.
7. Authentication Matters
Unauthenticated access to exposed services dramatically increases the consequences of a vulnerability.
8. Chained Vulnerabilities Are Dangerous
The attackers reportedly combined application execution with sandbox escape.
9. Privilege Escalation Changes Everything
Reaching SYSTEM-level privileges gives attackers vastly greater control.
10. Persistence Is the Turning Point
A vulnerability creates entry.
A web shell can create staying power.
- Software Modification Is More Dangerous Than Ordinary Malware Delivery
Replacing an installer can allow one compromised server to infect many users.
12. Supply-Chain Attacks Multiply Impact
The attacker no longer needs to compromise every target individually.
- One Trusted Server Can Become a Malware Distribution Point
That is the central danger exposed by this campaign.
14. Cloud Services Can Hide Command Traffic
Using legitimate services such as OneDrive can make simplistic network blocking less effective.
15. LSASS Remains a High-Value Target
Credential material can provide attackers with opportunities far beyond the initial server.
16. Basic Commands Still Matter
Commands such as hostname and whoami can reveal critical information to an intruder.
17. Attackers Often Start With Simple Reconnaissance
Sophisticated operations are frequently built from very ordinary commands.
- Reverse Tunnels Can Defeat Assumptions About Firewalls
Outbound connectivity can become an
19. Patching Must Be Followed by Hunting
A vulnerability fix does not prove that an attacker was removed.
20. Historical Compromise Changes the Response
If exploitation happened before patching, incident response becomes necessary.
21. File Integrity Monitoring Is Essential
Unexpected modifications to application files should never be ignored.
22. Installer Integrity Matters
Organizations should verify the authenticity of software before execution.
- Third-Party Risk Is Now First-Class Security Risk
Your organization’s security can depend on another company’s patching discipline.
24. Security Teams Need Software Inventories
You cannot protect versions you do not know you are running.
25. Internet-Facing Assets Need Continuous Monitoring
A quarterly scan is not enough for high-value exposed infrastructure.
26. EDR Must Watch Behavior
Attackers can rename malware, modify files, and abuse legitimate infrastructure.
- Detection Engineering Should Follow the Attack Chain
Teams should detect exploitation, persistence, credential access, and lateral movement separately.
28. Network Segmentation Limits Damage
Even a successful compromise should have somewhere it cannot go.
- Organizations Should Assume Attackers Will Abuse Trust
Trusted channels are increasingly attractive to threat actors.
30. Security Updates Need Urgency
Waiting weeks to patch an internet-facing server can create an unnecessary window of opportunity.
31. Collaboration Infrastructure Belongs in Security Reviews
It should not be treated merely as an IT convenience.
32. Vendor Security Advisories Should Be Operationalized
A security bulletin is useful only if someone acts on it.
33. Vulnerability Management Should Include Exposure Analysis
Knowing that a CVE exists is less useful than knowing which systems are reachable and exploitable.
34. Incident Response Should Include Software Distribution
Investigators must ask whether compromised infrastructure delivered malicious files.
35. Customers and Partners Should Be Considered
Security teams should examine whether employees connect to externally managed collaboration servers.
36. The Modern Perimeter Is Trust-Based
The dangerous system may be outside the
37. Attackers Are Looking for Multipliers
A server that can distribute software is more valuable than a server that only stores information.
38. Convenience Can Become an Attack Vector
Automatic updates are convenient until the update source is compromised.
39. The Strongest Defense Is Layered
Patching, segmentation, EDR, identity protection, application control, and monitoring must work together.
40. The TrueConf Incident Is a Warning
The broader message is larger than one vendor or one hacking group: any trusted enterprise platform capable of distributing software can become a supply-chain weapon when attackers gain control of it.
✅ TrueConf Vulnerabilities Were Patched
The affected TrueConf Server branches identified in the report were addressed in versions 5.3.9, 5.4.9, and 5.5.5, released on June 18, 2026.
Organizations running older versions should therefore prioritize verification and upgrading rather than assuming their installations are protected.
✅ The Attack Involved More Than Initial Exploitation
The reported operation included application compromise, sandbox escape, privilege escalation, persistence, reconnaissance, and malware deployment.
This means the incident should be understood as a complete intrusion chain rather than simply a vulnerability being exploited.
✅ PhantomCore and PhantomGraph Were Reported as Separate Components
Kaspersky attributed different capabilities to the two malware families.
PhantomCore was associated with the malicious TrueConf installer, while PhantomGraph was described as a separate backdoor capable of receiving commands and returning results through a OneDrive-based mechanism.
⚠️ A Patch Does Not Prove a Server Is Clean
Installing a fixed version protects against the known vulnerability going forward, but it cannot automatically remove persistence mechanisms that may already have been installed.
Organizations that suspect exploitation should perform a compromise assessment rather than relying solely on version numbers.
⚠️ Third-Party Exposure Is a Major Concern
An organization may interact with a compromised TrueConf server operated by another entity.
That makes software provenance, endpoint monitoring, installer verification, and third-party security assessments increasingly important.
Prediction
(+1) Enterprise Collaboration Platforms Will Receive More Security Attention
As organizations increasingly rely on self-hosted communication platforms, security teams are likely to treat these systems as critical infrastructure rather than ordinary workplace software.
The TrueConf campaign demonstrates why.
(+1) Software Integrity Checks Will Become More Common
Organizations are likely to increase the use of digital-signature validation, application allowlisting, endpoint controls, and software-hash monitoring for applications delivered through internal or third-party infrastructure.
(+1) Third-Party Risk Programs Will Expand
Security teams will increasingly ask vendors and contractors how their collaboration platforms are patched, monitored, segmented, and protected against supply-chain attacks.
(-1) Unpatched Internet-Facing Servers Will Remain Attractive Targets
Organizations that delay patching publicly exposed infrastructure will continue to provide attackers with valuable entry points.
(-1) Trusted Updates Will Become a Bigger Attack Surface
Attackers are increasingly interested in compromising the mechanisms users already trust.
The next major software supply-chain incident may not begin with a suspicious download.
It may begin with an update that appears completely legitimate.
Final Thoughts: The Meeting Was Never the Real Target
The most important lesson from the Head Mare campaign is that attackers were not simply looking for a way into a video-conferencing application.
They were looking for trust.
A vulnerable TrueConf server gave them the initial foothold. Privilege escalation gave them control. A web shell gave them persistence. PhantomGraph gave them remote capabilities. But the most powerful opportunity came from the server’s position inside a trusted software-delivery chain.
That is what makes this campaign so dangerous.
A compromised server can become a silent intermediary between attackers and employees who have done nothing obviously wrong. A user can attend a meeting, download an update, and unknowingly execute malware originating from infrastructure they believed was trustworthy.
The modern enterprise therefore needs to rethink what “trusted software” actually means.
Trust should not be based solely on where a file came from.
It should be supported by cryptographic verification, endpoint controls, behavioral monitoring, network segmentation, strong identity protections, continuous vulnerability management, and rapid incident response.
For organizations running TrueConf Server, the immediate priority is clear: identify affected versions, upgrade to patched releases, investigate for signs of previous compromise, and determine whether any client installers were altered or distributed during the exposure period.
For everyone else, the warning is broader.
Every server that distributes software is part of your security boundary.
Every contractor can become part of your attack surface.
Every trusted update mechanism can become a weapon.
And in an era where attackers increasingly exploit relationships rather than individual machines, the safest organization is not the one that assumes its trusted systems are safe.
It is the one that continuously verifies them.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.instagram.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
