The Head Mare hacktivist group has been exploiting two unpatched vulnerabilities in TrueConf Server — a video conferencing platform widely used in Russian enterprise and government environments — to silently replace the client installer served by each affected server with a backdoored version. Anyone who downloaded what looked like a routine TrueConf update from a compromised server received the PhantomCore backdoor instead of legitimate software.
Kaspersky discovered the campaign in July. The attack chain starts on TCP port 4307, which TrueConf servers expose by default without authentication. Head Mare used that entry point with two internally tracked vulnerabilities (KLCERT-26-057 and KLCERT-26-058) to execute code inside TrueConf’s sandboxed environment, then escape the sandbox and gain SYSTEM-level privileges on the underlying Windows server. From there, attackers planted a web shell in \public\js\locale.php for persistent access, reached the TrueConf database, and swapped out the legitimate client installer with a trojanized, unsigned copy. They also deployed a second implant called PhantomGraph — two DLL files (SysExcSvc.dll and SysReadSvc.dll) that receive commands through a Microsoft OneDrive account, execute them, and return results. Observed PhantomGraph activity included dumping LSASS memory to steal credentials, hostname reconnaissance, and establishing a reverse SSH tunnel.
Kaspersky’s warning carries an important caveat: an organization does not need to run its own TrueConf server to be at risk. Employees who connect to a compromised partner’s TrueConf server to join a meeting and then download an installer update will receive the backdoored package. Head Mare is currently running multiple active campaigns targeting Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development sectors, using phishing, exploitation of internet-facing servers, and contractor access as initial entry points.
How to check if you’re affected
Affected versions are TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and all older versions. TrueConf released patched builds (5.3.9, 5.4.9, 5.5.5) on June 18, 2026. Administrators running on-premises TrueConf servers should verify their version, apply the update immediately, and audit server logs for signs of web shell activity in the locale.php file or unexpected files in the installer directory. Endpoint teams should scan for SysExcSvc.dll and SysReadSvc.dll as indicators of a PhantomGraph installation.
Sources
- BleepingComputer — Hackers breach TrueConf to trojanize client installers with backdoors
- Kaspersky SecureList — Head Mare targets TrueConf Server with PhantomCore (Russian-language research report, securelist.ru/116557)