[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"focus:head-mare-apt-is-exploiting-vulnerabilities-in-an-unpatched-trueconf-server-to-d-msq3rgsy":3},{"item":4},{"id":5,"title":6,"slug":7,"summary":8,"severity":9,"category":10,"cve_ids":11,"affected_products":12,"action_required":15,"article_ids":16,"ioc_summary":18,"source_urls":19,"status":21,"expires_at":22,"created_at":23,"updated_at":24,"articles":25},"514ca74f-58d0-495b-84db-f9eafbcdee2d","Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants","head-mare-apt-is-exploiting-vulnerabilities-in-an-unpatched-trueconf-server-to-d-msq3rgsy","Head Mare APT is actively exploiting two vulnerabilities in unpatched TrueConf servers to deploy PhantomCore and PhantomGraph backdoors to conference participants. Affected organizations using TrueConf are at immediate risk of system compromise and privilege escalation. Attackers are replacing legitimate client installers and using OneDrive for command and control.","critical","advisory",[],[13,14],"TrueConf Server","Microsoft","Identify and patch all TrueConf servers immediately. Scan for suspicious OneDrive C2 communications and monitor for PhantomCore\u002FPhantomGraph indicators. Check client installer integrity and review conference participant endpoints for signs of compromise.",[17],"0bb07bc8-1da3-4a1f-8c38-e487cb2eef4c",null,[20],"https:\u002F\u002Fsecurelist.com\u002Ftr\u002Fhead-mare-targets-trueconf-server-with-phantomcore\u002F120988\u002F","archived","2026-08-14T13:05:48.157+00:00","2026-08-12T13:05:56.49239+00:00","2026-08-14T14:06:15.700835+00:00",[26],{"id":17,"title":6,"url":20}]