Russian hacktivists hijack TrueConf video servers to push booby-trapped installers
Kaspersky says the Head Mare group exploited two unpatched flaws in TrueConf conferencing servers to swap the real client installer for one carrying the PhantomCore backdoor.
Key points
- Kaspersky says the hacktivist group Head Mare has been breaking into unpatched TrueConf video conferencing servers to replace the client installer with a malicious copy.
- The attackers chain two flaws, tracked internally by Kaspersky as KLCERT-26-057 and KLCERT-26-058, to run code as SYSTEM on the server.
- TrueConf fixed the bugs on 18 June in versions 5.3.9, 5.4.9 and 5.5.5.
- Victims download a trojanised, unsigned installer carrying the PhantomCore backdoor when their organisation pushes a routine update.
- Head Mare is running multiple active campaigns against Russian firms in transport, energy, electronics, IT and software.
Head Mare, a pro-Ukrainian hacktivist crew, has been quietly turning corporate video conferencing servers into malware delivery trucks. The target is TrueConf, a Russian on-premise alternative to Zoom and Microsoft Teams that is popular with government agencies and large enterprises.
Researchers at Kaspersky spotted the campaign in July and published the details this week. In practice, the attack is elegant and nasty: break the server, then let the server infect its own users through what looks like a normal update.
How did the hackers get in?
They walked in through a port that was open by default. TrueConf servers listen on TCP port 4307, and Kaspersky found the attackers could connect to it without any login at all.
From there, Head Mare chained two bugs. One, tracked by Kaspersky as KLCERT-26-057, let them run a malicious script inside TrueConf's sandbox, meaning the isolated area the software is supposed to keep code trapped in. The second, KLCERT-26-058, let them escape that sandbox and run commands directly on the Windows machine underneath.
Once out, they elevated to NT AUTHORITY\SYSTEM, the highest privilege level on a Windows server. They then overwrote a file called locale.php with a web shell, a small piece of code that gives an attacker a remote control panel on the compromised machine.
TrueConf patched both flaws on 18 June in versions 5.3.9, 5.4.9 and 5.5.5. Anything older is exposed.
What happens to staff who join a meeting?
They get a poisoned installer. When employees connect to their company's TrueConf server, the server offers them what looks like a routine client update. The file is not digitally signed, and it carries a backdoor called PhantomCore.
This is the part that should worry security teams at organisations that don't even run TrueConf themselves. Kaspersky warns that staff often join meetings hosted by suppliers, customers or partners, and download the client from whichever server is hosting the call. One compromised counterparty is enough to seed malware across a supply chain.
A second backdoor, PhantomGraph, ships as two DLL files and takes its orders through a Microsoft OneDrive account, which helps the traffic blend in with normal cloud activity. Kaspersky saw the operators use it to dump memory from LSASS, the Windows process that holds login credentials, and to open a reverse SSH tunnel back to their infrastructure.
Who is being targeted?
Russian companies, across a wide mix of sectors. Kaspersky lists instrumentation, electronics, transport, energy, IT and software development as current victims. Initial access is not just TrueConf: the group also uses phishing, meaning fake emails designed to steal passwords or drop malware, and breaks in through contractors' networks.
As first reported by BleepingComputer, this is not TrueConf's first bad year. In April, another group tied to Chinese operators was seen abusing a separate zero-day, CVE-2026-3502, in a campaign dubbed Operation True Chaos, also to trojanise client updates.
Affected versions at a glance
| Branch | Vulnerable | Fixed in | Patch date |
|---|---|---|---|
| 5.3.x | before 5.3.9 | 5.3.9 | 18 Jun |
| 5.4.x | before 5.4.9 | 5.4.9 | 18 Jun |
| 5.5.x | before 5.5.5 | 5.5.5 | 18 Jun |
The failure mode here is depressingly familiar. An on-prem appliance sits inside the trust boundary, exposes an unauthenticated port to the world, and becomes the perfect place to poison a signed-looking update pipeline. One thing the post-mortem will say: default-open management ports on video kit deserve the same scrutiny as any exposed database.
Operational takeaway: patch to 5.3.9/5.4.9/5.5.5, block port 4307 at the edge, and reject any TrueConf client installer that isn't digitally signed.
