Full Report
Threat Alert
Analysis Summary
# Threat Actor: Head Mare
## Attribution & Identity
* **Name:** Head Mare
* **Aliases/Associations:** Described as a "hacktivist" or APT group; known for deploying the **PhantomCore** malware family.
* **Origin/Affiliation:** Often associated with activities targeting Russian organizations.
## Activity Summary
* **Recent Campaigns:** In mid-2026, the group was observed exploiting vulnerabilities in the **TrueConf** video conferencing platform.
* **Operation:** The group compromises TrueConf servers to replace legitimate client installers with versions bundled with PhantomCore malware. This allows them to infect any conference participant who downloads the updated client from the compromised server.
## Tactics, Techniques & Procedures
* **Vulnerability Exploitation:**
* **KLCERT-26-057:** Missing authentication for critical functions (Port 4307/TCP) used to execute malicious scripts in an isolated environment.
* **KLCERT-26-058:** Breakout from isolated environment to achieve code execution with `NT AUTHORITY\SYSTEM` privileges.
* **Persistence:**
* Creation of malicious Windows services: `SysExcSvc` and `SysReadSvc`.
* Installation of web shells at `.../httpconf/site/public/js/locale.php`.
* **Evasion:** Intercepting network functions on *nix systems to hide files and communications; deleting event logs.
* **C2 Communication:**
* Use of **Microsoft OneDrive** (via Microsoft Graph API) as a command-and-control channel.
* Use of **GitHub** as a C2 channel for *nix-based backdoors.
* **Supply Chain Attack (Internal):** Modifying the local server's distribution files (`trueconf_windows_client_x64.exe`) to infect downstream users.
## Targeting
* **Sectors:** Government, corporate communications, and various Russian organizations.
* **Geography:** Primarily Russia, though any organization interacting with compromised TrueConf servers (contractors, partners) is at risk.
* **Victims:** Users of the TrueConf video conferencing platform and organizations running on-premise TrueConf servers.
## Tools & Infrastructure
* **Malware:**
* **PhantomCore:** A modular malware consisting of an exchange module (`graphi_exchange.dll`) and an executor module (`graphi_reader.dll`).
* **Web Shells:** PHP-based shells for initial reconnaissance and database access.
* **Infrastructure:**
* **C2:** `graph[.]microsoft[.]com` (OneDrive), `login[.]microsoftonline[.]com`, and GitHub.
* **Ports:** Exploitation occurs over 4307/TCP.
## Implications
This actor demonstrates high technical proficiency by chaining proprietary zero-day (or recently patched) vulnerabilities. By targeting communication infrastructure, they gain a high-leverage position to conduct lateral movement and secondary infections across organizational boundaries (from server owner to meeting participants).
## Mitigations
* **Patching:** Immediately update TrueConf Server to versions **5.3.9, 5.4.9, 5.5.5**, or later.
* **Network Security:** Restrict access to port **4307/TCP** to authorized IP addresses only.
* **Endpoint Defense:** Monitor for the creation of services named `SysExcSvc` and `SysReadSvc`.
* **File Integrity:** Verify the integrity of the TrueConf client distribution files on the server.
* **Detection:** Implement the provided YARA rules to scan for PhantomCore modules (`graphi_exchange.dll` and `graphi_reader.dll`) within the environment.