Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants

Head Mare APT is actively exploiting two vulnerabilities in unpatched TrueConf servers to deploy PhantomCore and PhantomGraph backdoors to conference participants. Affected organizations using TrueConf are at immediate risk of system compromise and privilege escalation. Attackers are replacing legitimate client installers and using OneDrive for command and control.