Russian hacktivists hijack TrueConf video servers to push booby-trapped installers
Kaspersky says the Head Mare group exploited two unpatched flaws in TrueConf conferencing servers to swap the real client installer for one carrying the PhantomCore backdoor.
Key points
- Kaspersky says the hacktivist group Head Mare has been breaking into unpatched TrueConf video conferencing servers to replace the client installer with a malicious copy.
- The attackers chain two flaws, tracked by Kaspersky as KLCERT-26-057 and KLCERT-26-058, to run code as SYSTEM on the server.
- TrueConf fixed both bugs on 18 June in versions 5.3.9, 5.4.9 and 5.5.5.
- Victims download a trojanised, unsigned installer carrying the PhantomCore backdoor during what looks like a routine update.
- Head Mare is running multiple active campaigns against Russian firms in transport, energy, electronics, instrumentation and software development.
Head Mare, a pro-Ukrainian hacktivist crew, has been turning corporate video conferencing servers into malware delivery trucks. The target is TrueConf, a Russian on-premise alternative to Zoom and Microsoft Teams popular with government agencies and large enterprises.
Kaspersky spotted the campaign in July and published details this week. The attack is elegant and nasty: compromise the server, then let the server infect its own users through what looks like a normal update. We covered a structurally identical campaign against ViPNet, another Russian enterprise tool, back in July, when HelloNet was slipping malicious files into updates hitting Russian ministries and energy firms. The tradecraft is the same; only the product name changed.
How did the hackers get in?
They walked in through a port open by default. TrueConf servers listen on TCP port 4307, and attackers could connect without any credentials at all.
From there, Head Mare chained two bugs. KLCERT-26-057 let them run a malicious script inside TrueConf's sandbox, the isolated environment the software uses to contain code. KLCERT-26-058 let them break out of that sandbox and run commands directly on the Windows machine underneath.
Once out, they elevated to NT AUTHORITY\SYSTEM, the highest privilege level on a Windows server. They then replaced a file called locale.php with a web shell, a small piece of code that gives an attacker persistent remote access to the machine. Kaspersky notes they also used that foothold to access the TrueConf database before touching the installer.
TrueConf patched both flaws on 18 June in versions 5.3.9, 5.4.9 and 5.5.5. Anything older is exposed.
What happens to staff who join a meeting?
They get a poisoned installer. When employees connect to their company's TrueConf server, the server offers what looks like a routine client update. The file is not digitally signed, and it carries PhantomCore.
Security teams at organisations that don't run TrueConf themselves should not treat this as someone else's problem. Kaspersky warns that staff often join meetings hosted by counterparties and pull the client from whichever server is running the call. One compromised supplier is enough to seed malware into your environment.
A second backdoor, PhantomGraph, ships as two DLL files and takes commands through a Microsoft OneDrive account, which helps traffic blend into normal cloud activity. Kaspersky saw operators use it to dump LSASS memory, the Windows process holding login credentials, and to open a reverse SSH tunnel back to attacker infrastructure.
Who is being targeted?
Russian organisations across several sectors. Kaspersky lists instrumentation, electronics, transport, energy and software development as active targets. Initial access isn't limited to TrueConf: Head Mare also uses phishing and contractor network access to get in.
In April 2026, CheckPoint Research reported a separate zero-day in TrueConf, tracked as CVE-2026-3502, used in a campaign called Operation True Chaos and attributed tentatively to Chinese threat actors. Two different groups, two different zero-days, the same update-poisoning playbook.
Affected versions at a glance
| Branch | Vulnerable | Fixed in | Patch date |
|---|---|---|---|
| 5.3.x | before 5.3.9 | 5.3.9 | 18 Jun |
| 5.4.x | before 5.4.9 | 5.4.9 | 18 Jun |
| 5.5.x | before 5.5.5 | 5.5.5 | 18 Jun |
Should you worry?
Yes, and not only if you run TrueConf. The real exposure here is supply-chain reach: your staff pull software from servers you don't control. An unauthenticated management port on video conferencing kit deserves the same firewall rule you'd put in front of an exposed RDS instance. Patch to the fixed versions, block port 4307 at the perimeter, and reject any TrueConf client installer that isn't digitally signed. The post-mortem writes itself if you don't.
