Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants

Summary

The Head Mare APT group is exploiting two new vulnerabilities (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf video conferencing servers to deliver the PhantomCore and PhantomGraph backdoors. Attackers gain system-level privileges, replace client installers with infected versions, and use Microsoft OneDrive for C2 communication.

Full text

Threat Response Table of Contents Overview of the attackDetection by Kaspersky solutionsIndicators of compromiseFile hashes (MD5)IPDomainsWindows service namesFile pathsRegistry keysKaspersky detection namesYARA rules Overview of the attack In July 2026, Kaspersky experts detected a new attack by the Head Mare group. Previously, we classified them as hacktivists, but now we define them as an APT group due to the sophistication of their TTPs and the absence of destructive activity (encryption, wiping) in the targeted infrastructures. In this latest campaign, the attackers exploited a chain of vulnerabilities in the TrueConf video conferencing server and replaced the original TrueConf client installers with infected versions that installed the PhantomCore malware on the system. An investigation of the compromised server revealed that the attackers used a combination of two new vulnerabilities (assigned internal identifiers KLCERT-26-057 and KLCERT-26-058), allowing them to execute arbitrary code with the highest privileges. The attack occurs in several stages: The attackers connect to the TrueConf server without prior authorization via port 4307/TCP, which, according to the product documentation, is open by default. The attack affects TrueConf servers running versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, and 5.5.X through 5.5.5. Once connected, attackers call a server function to transmit a malicious script and execute it on the server. The vulnerability that allows this stage of the attack to be carried out has been assigned the internal identifier KLCERT-26-057. The received script runs on the TrueConf server in an isolated environment. By default, operating system functions are not accessible in this environment, which should limit the capabilities of the executed code. To escape the isolated environment, attackers exploit a second vulnerability, assigned the internal identifier KLCERT-26-058. Exploiting this vulnerability allows them to bypass the restrictions of the isolated environment and proceed to execute commands in the context of the operating system. Once the environment’s restrictions are bypassed, attackers gain the ability to execute arbitrary code on the server with the privileges of the NT AUTHORITY\SYSTEM account. Once they have gained elevated privileges, attackers replace the file …\public\js\locale.php with a web shell, which can be used for subsequent remote control of the compromised server. This web shell was used for the following activities: collecting data about the IT infrastructure; gaining privileged access to the TrueConf database; replacing the original TrueConf Client distribution with an infected version containing the PhantomCore backdoor. The vulnerabilities exploited by the attackers were patched by the vendor in the latest TrueConf Server updates (versions 5.3.9, 5.4.9, and 5.5.5). These updates were released on June 18, 2026. The PhantomCore backdoor was successfully detected by Kaspersky solutions. To automatically launch the malware after the system boots, a registry key is created: HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32, with the value set to the path to the malicious program’s file. Using a web shell, in addition to PhantomCore, the attackers load a backdoor that we have named PhantomGraph, consisting of two modules: SysExcSvc.dll is responsible for receiving commands from the attackers and transmitting the results of their execution. The attackers used an account on Microsoft OneDrive cloud storage as their command-and-control (C2) server. SysReadSvc.dll reads the command transmitted by the first module, executes it, and saves the execution result. To establish persistence on the system, the attackers execute a Base64-encoded PowerShell command that installs SysExcSvc.dll and SysReadSvc.dll as Windows services. We believe the attackers deliberately split this malicious command into two components to make it harder to detect using EDR tools. Additionally, the program’s code partially matches that of PhantomCore, indicating that it belongs to the Head Mare group’s arsenal. We also managed to identify the commands executed by the attackers when connecting to the backdoor. The SysReadSvc module executes commands using a BATCH file. Example of execution: $system32\cmd.exe /c cmd /c ""$temp\cmd_cmd_4488.bat"" 2>&1 1 $system32\cmd.exe /c cmd /c ""$temp\cmd_cmd_4488.bat"" 2>&1 Commands detected: Memory dump of the lsass.exe process: Reconnaissance of the user and system names: hostname whoami "$system32\WindowsPowerShell\v1.0\powershell.exe" -noexit -command Set-Location -literalPath '$system32\inetsrv' 12345 hostname whoami "$system32\WindowsPowerShell\v1.0\powershell.exe" -noexit -command Set-Location -literalPath '$system32\inetsrv' Launching an SSH reverse tunnel: In addition, we discovered several commands that did not work due to the attackers’ typos and encoding issues. We are observing several active Head Mare campaigns targeting Russian organizations across various industries: instrument manufacturing, electronics, transportation, energy, IT, and software development. The attackers distribute their backdoors using various methods, including phishing, exploiting public web servers, or through a subcontractor. We recommend that all organizations using TrueConf software install the latest server version (versions 5.3.9, 5.4.9, and 5.5.5) in accordance with the vendor’s recommendations. We also recommend verifying that the client distributions downloaded from the TrueConf server used by your organization have a valid TrueConf digital signature and have not been tampered with. The malicious distributions we detected do not have a valid digital signature. You can also verify authenticity on the vendor’s website. Important: Even if your organization does not use a TrueConf server, your employees may connect to compromised TrueConf servers belonging to business partners to participate in online meetings and download infected installation packages. The attack mechanism and the vulnerabilities exploited will be described in more detail on the Kaspersky ICS CERT website. Detection by Kaspersky solutions Kaspersky security solutions successfully detect malicious activity associated with the attacks described above. The malware used in this attack is detected by our solutions with the following detection names: Backdoor.PHP.WebShell.abi, Backdoor.Win64.PhantomCore.dt, Trojan.Win64.Agent.smgvnc, Trojan.Win64.Agent.smgvnb, HEUR:Backdoor.Win64.PhantomCore.gen, HEUR:Backdoor.Linux.Agent.fb, HEUR:Backdoor.Linux.PhantomHook.a, HEUR:Backdoor.Linux.PhantomReact.a, Trojan.Win64.PhantomGraph.gen UDS:Backdoor.Win64.PhantomCore.a Let’s take a closer look using Kaspersky Endpoint Detection and Response Expert (KEDR Expert) as an example. Specifically, activity involving the replacement of the legitimate file …\public\js\locale.php with a web shell, as well as the deletion of entries from TrueConf event logs, is detected by the rule unusual_php_file_creation_from_trueconf_process. Downloading a file containing the PhantomCore backdoor via the replaced legitimate file …\public\js\locale.php is detected by KEDR Expert with the rule unusual_file_creation_from_trueconf. Activity related to the installation of an infected TrueConf client installer containing the PhantomCore backdoor is detected by KEDR Expert using the unsigned_trueconf_installer rule. The Kaspersky Managed Detection and Response service detects the described attack by monitoring the following actions: Creation of suspicious files by TrueConf Server processes. Execution of a TrueConf Client installer file that lacks a software developer’s signature. Suspicious process chains associated with TrueConf Client executables and TrueConf Client update executables. Registration of suspicious libraries in the HKEY_CURRENT_USER\Software\Classes\CLSID\ registry key. Actions related to retrieving information about the lsas

Indicators of Compromise

• mitre_attack — T1059.001
• mitre_attack — T1547.001
• mitre_attack — T1071.004
• mitre_attack — T1190
• mitre_attack — T1047
• malware — PhantomCore
• malware — PhantomGraph

Entities