TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Summary

The threat actor Head Mare is exploiting unpatched TrueConf Server vulnerabilities (KLCERT-26-057 and KLCERT-26-058) to replace client installers with versions containing the PhantomCore backdoor. These vulnerabilities allow for arbitrary code execution with elevated privileges, enabling attackers to gain control of the server, access sensitive data, and deploy malware. The attack chain involves exploiting flaws to execute malicious scripts, break out of isolated environments, and establish persistent access via web shells and Windows services.

Full text

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore Ravie LakshmananAug 10, 2026Malware / Vulnerability The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning instrumentation, electronics, transport, energy, IT, and software development sectors. Russian cybersecurity vendor Kaspersky said it detected the attacks in July 2026. The activity involves exploiting a vulnerability chain in the TrueConf videoconferencing server to replace the original TrueConf client installers with poisoned versions that deliver the PhantomCore backdoor and remote access trojan (RAT) into susceptible systems. The vulnerabilities, tracked as KLCERT-26-057 and KLCERT-26-058, enable arbitrary code execution with elevated privileges. The attack impacts TrueConf server versions 5.3.x up to 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and earlier. The attack chain is as follows - Attackers connect to the TrueConf server on TCP port 4307, which is open by default. Upon successful connection, the attackers exploit KLCERT-26-057 to run a malicious script on the server. The script launches within an isolated environment on the server, limiting its access to operating system functions. The attackers then exploit KLCERT-26-058 to break out of the isolated environment and run arbitrary commands on the underlying host. The attackers run arbitrary code on the server with NT AUTHORITY\SYSTEM privileges. The attackers replace the file "...\public\js\locale.php" with a web shell to facilitate persistent remote access to the compromised server. The web shell, per Kaspersky, has been leveraged to collect data on the IT infrastructure, gain privileged access to the TrueConf database, and ultimately substitute the original TrueConf Client distribution with an infected version containing PhantomCore. What's more, the web shell serves as a conduit for another backdoor codenamed PhantomGraph that shares some level of code overlap with PhantomCore and includes two DLL modules - "SysExcSvc.dll," for receiving commands and exfiltrating their results back to Microsoft OneDrive cloud storage that's used as command-and-control (C2) "SysReadSvc.dll," for parsing the commands received by the first module, executing it, and storing the results "To establish a persistent presence in the system, the attackers execute a Base64-encoded PowerShell command that installs SysExcSvc.dll and SysReadSvc.dll as Windows services," Kaspersky said. "We believe the attackers deliberately split this malware into two components to make it harder for EDR tools to detect." In addition, the threat actors have been found to launch an SSH reverse tunnel, take a memory dump of the "lsass.exe" process, and collect general system information using commands like hostname and whoami. The vulnerabilities have since been patched by the vendor in the latest TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5 released on June 18, 2026. Organizations using TrueConf are advised to download the latest versions for optimal protection. This is not the first time Head Mare has targeted zero-day flaws in TrueConf to single out Russian entities. Earlier this April, Positive Technologies disclosed that three vulnerabilities in the software (BDU:2025-10114, BDU:2025-10115, and BDU-2025-10116) were abused by the group since September 2025 to deliver PHP web shells and malicious payloads for information theft and command execution. Around the same time, Check Point also reported that another high-severity security flaw in the TrueConf client (CVE-2026-3502) was exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia to deploy the Havoc C2 framework. ViPNet Update Mechanism Hijacked to Deploy HelloInjector and HelloProxy The development comes weeks after Kaspersky said it discovered a new advanced persistent threat (APT)-style attack that has been ongoing since at least May 2026 using previously unreported tooling, primarily by taking advantage of the update mechanism for the ViPNet product suite to target Russian government, energy, transport, education, and logistics sectors. The HelloNet attack involves the execution of a malicious DLL ("wtsapi32.dll") that masquerades as a legitimate file associated with the ViPNet suite update system. The loader DLL, dubbed HelloInjector, is sideloaded by the ViPNet update binary "itcsrvup64.exe," resulting in the execution of the malicious payload from within "svchost.exe." "After starting, the malware checks the process in the context of which it was launched," Kaspersky said. "If the name of the main process is not svchost.exe, the loader starts iterating through all processes running in the operating system. It looks for a process whose name contains the string svchost, and whose command line contains the string netsvcs." "If such a process is found, the loader injects itself into the target process using the NtWriteVirtualMemory and NtCreateThreadEx functions." Once restarted inside the new process, the loader checks the process name a second time for the presence of the string "svchost." If found, HelloInjector loads and executes the malicious payload that's stored in its body in plaintext. The payload is a hidden proxy and a loader for additional modules retrieved from a C2 server. It has been codenamed HelloProxy. Besides taking steps to interfere with the normal functioning of security solutions operating in user mode for filtering network connections, it serves as a loader for two components - HelloExecutor, to execute commands on the infected system and launch an SSH tunnel to attacker infrastructure HelloCleaner, to clean ViPNet software log files and erase forensic trail Also discovered in one of the infected systems is a Rust implant named HelloBackdoor that can enable file uploads and downloads to and from the C2 server. Commands that do not match a predefined format are interpreted as instructions to be executed via "cmd.exe." At this stage, it's clear how the threat actors are delivering the rogue "wtsapi32.dll" DLL to target machines. The activities have been tied to an unknown Chinese-speaking APT with low confidence, citing a reference to the Chinese website sina[.]com and an open-source software download mirror ("mirrors.ustc.edu[.]cn") hosted by the University of Science and Technology of China. With fake updates for ViPNet having been leveraged in prior attacks targeting Russia, the findings indicate how widely-used programs in the country are becoming lucrative vectors for advanced threat actors. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Advanced Persistent Threat, Code Execution, Malware, Remote Access Trojan, Supply Chain Attacks, Vulnerability, Web Shell, Windows Security, Zero Day ⚡ Top Stories This Week Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains Use Browser Fingerp

Indicators of Compromise

• ip — 4307
• malware — PhantomCore
• malware — PhantomGraph
• malware — SysExcSvc.dll
• malware — SysReadSvc.dll
• cve — CVE-2026-3502

Entities