Full Report
The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors. [...]
Analysis Summary
# Incident Report: Trojanization of TrueConf Installers by Head Mare
## Executive Summary
The "Head Mare" hacktivist group exploited critical vulnerabilities in unpatched TrueConf video conferencing servers to gain unauthorized access and system-level privileges. By replacing legitimate client installers with trojanized versions, the attackers distributed the "PhantomCore" and "PhantomGraph" backdoors to connected users and organizations. This campaign effectively turned a trusted communication platform into a malware distribution hub, impacting multiple critical infrastructure sectors in Russia.
## Incident Details
- **Discovery Date:** July 2026
- **Incident Date:** Ongoing (Vulnerabilities patched June 18, 2026)
- **Affected Organization:** Multiple (Unspecified Russian organizations)
- **Sector:** Instrumentation, electronics, transportation, energy, IT, and software development
- **Geography:** Russia
## Timeline of Events
### Initial Access
- **Date/Time:** July 2026 (Detection)
- **Vector:** Exploitation of unpatched TrueConf Server vulnerabilities (KLCERT-26-057 and KLCERT-26-058) via TCP port 4307.
- **Details:** Attackers connected to the target server without authentication to execute arbitrary scripts and escape the sandbox environment.
### Lateral Movement
- **Techniques:** After gaining `NT AUTHORITY\SYSTEM` privileges, attackers deployed a web shell for persistent access and moved laterally by replacing legitimate software updates on the server.
- **Supply Chain Infection:** Compromised servers served trojanized installers to all connecting clients, including external counterparties.
### Data Exfiltration/Impact
- **Credential Theft:** Dumped LSASS memory to steal credentials.
- **Intelligence Gathering:** Used web shells to access the TrueConf database and environment information.
- **Malware Deployment:** Distributed PhantomCore (via installer) and PhantomGraph (via C2).
### Detection & Response
- **Discovery:** Detected by Kaspersky researchers during monitoring of Head Mare campaigns.
- **Response Actions:** Vulnerabilities patched by the vendor (TrueConf) in mid-June; public disclosure of IOCs by researchers.
## Attack Methodology
- **Initial Access:** Exploitation of unpatched public-facing TrueConf servers (Port 4307), phishing, and contractor access.
- **Persistence:** Web shell placed in `\public\js\locale.php`.
- **Privilege Escalation:** Exploited sandbox escape flaws to reach `NT AUTHORITY\SYSTEM`.
- **Defense Evasion:** Use of non-digitally signed updates; PhantomGraph utilizes legitimate cloud services (Microsoft OneDrive) for C2.
- **Credential Access:** LSASS memory dumping.
- **Discovery:** Execution of commands like `hostname` and `whoami`.
- **Lateral Movement:** Replacement of `TrueConf Client` installer to infect connecting users.
- **Collection:** Accessing TrueConf databases.
- **Exfiltration:** Reverse SSH tunnels and OneDrive-based C2.
- **Impact:** Compromise of the software supply chain; deployment of backdoors.
## Impact Assessment
- **Financial:** High potential cost for remediation and forensic investigation across multiple sectors.
- **Data Breach:** Exposure of internal databases and user credentials (LSASS).
- **Operational:** Disruption of secure video conferencing; necessity to reinstall all client-side software.
- **Reputational:** Significant damage to TrueConf’s standing as a "secure Zoom alternative."
## Indicators of Compromise
- **Network indicators:**
- Unauthenticated connections on TCP port 4307.
- Traffic to Microsoft OneDrive used for C2.
- **File indicators:**
- `\public\js\locale.php` (Web shell)
- `SysExcSvc.dll` & `SysReadSvc.dll` (PhantomGraph)
- Non-digitally signed TrueConf installers.
- **Behavioral indicators:**
- Unauthorized LSASS memory dumping.
- Sudden creation of reverse SSH tunnels.
## Response Actions
- **Containment:** Organizations must block port 4307 if not required or strictly firewall it.
- **Eradication:** Upgrading TrueConf Server to versions 5.3.9, 5.4.9, or 5.5.5.
- **Recovery:** Full audit of `\public\js\` directories and re-imaging of client machines that installed updates during the compromise window.
## Lessons Learned
- **Supply Chain Risk:** Even on-premise solutions can be turned into delivery mechanisms for malware if the host server is compromised.
- **Patch Management:** Delays in patching critical vulnerabilities (even by a few weeks) provided a sufficient window for hacktivists to weaponize the flaws.
- **Trust Verification:** Users often trust internal software update prompts blindly; the lack of a digital signature on the update should have been a high-priority alert.
## Recommendations
- **Immediate Patching:** Ensure TrueConf servers are running version 5.5.5 or higher.
- **Network Segmentation:** Restrict access to video conferencing management ports to authorized internal IPs only.
- **Endpoint Protection:** Use EDR solutions to monitor for LSASS dumping and suspicious child processes originating from communication software.
- **Third-Party Risk:** Advise employees to be cautious when joining TrueConf meetings hosted by external partners whose servers may be unpatched.