Full Report
Kaspersky experts have discovered malicious TrueConf software installers. The Head Mare APT group uses them to deliver the PhantomCore and PhantomGraph backdoors to target systems by exploiting vulnerabilities in an unpatched TrueConf server.
Analysis Summary
# Threat Actor: Head Mare
## Attribution & Identity
**Head Mare** is an Advanced Persistent Threat (APT) group that has been active since at least 2023. While the group maintains a presence on social media (specifically X/Twitter), where they often publicize their successful breaches, their specific state affiliation is not definitively confirmed in this report. They are known for targeting organizations within the CIS (Commonwealth of Independent States) region.
## Activity Summary
Recent activity involves the exploitation of unpatched **TrueConf Server** instances. In this campaign, the group leverages a known vulnerability (CVE-2023-50734) to gain initial access. Once inside the server, they replace legitimate TrueConf client installers with malicious versions. When unsuspecting users download and run these installers from their organization's internal server, they unknowingly execute the **PhantomCore** or **PhantomGraph** backdoors.
## Tactics, Techniques & Procedures
* **Exploitation of Remote Services:** Leveraging vulnerabilities in unpatched software (TrueConf Server). [T1210]
* **Supply Chain Compromise (Internal):** Modifying legitimate installers on a compromised internal server to infect employees. [T1195.001]
* **User Execution:** Relying on users to download and run the "updated" malicious installers. [T1204.002]
* **Backdoor Deployment:** Utilizing custom malware for command execution and data exfiltration.
* **Social Media Bragging:** Publicly announcing attacks on X (Twitter) to pressure victims or gain notoriety.
## Targeting
* **Sectors:** Government, manufacturing, and transportation sectors.
* **Geography:** Primarily targeting organizations in Russia and other CIS countries.
* **Victims:** Users of the TrueConf video conferencing platform within targeted organizations.
## Tools & Infrastructure
* **PhantomCore:** A custom backdoor written in Go, used for system reconnaissance and executing arbitrary commands.
* **PhantomGraph:** A modular backdoor that uses the Graph API (Microsoft) for Command and Control (C2) communication.
* **TrueConf Server:** Used as a pivot point and distribution hub for malware.
* **Infrastructure:**
* C2 Communication via legitimate services (Microsoft Graph API).
* Defanged IPs/Domains: `185[.]132[.]125[.]152`, `91[.]208[.]197[.]208`.
## Implications
Head Mare demonstrates a high level of pragmatism by combining public vulnerability exploits with internal supply chain attacks. By compromising a trusted internal communication tool like TrueConf, they bypass traditional perimeter defenses and exploit the inherent trust users have in their own company's software portal. Their use of the Microsoft Graph API for C2 (PhantomGraph) makes detection difficult, as the traffic blends in with legitimate cloud service communications.
## Mitigations
* **Patch Management:** Immediately update TrueConf Server to the latest version to remediate CVE-2023-50734.
* **Integrity Monitoring:** Implement File Integrity Monitoring (FIM) on software distribution directories to detect unauthorized changes to installers.
* **Endpoint Security:** Use EDR (Endpoint Detection and Response) solutions to identify suspicious parent-child process relationships (e.g., an installer launching a Go-based backdoor).
* **Network Filtering:** Monitor and restrict unusual traffic to Microsoft Graph API endpoints if they are not required for business operations.
* **User Training:** Educate employees to report any unusual behavior during software installation, even if the source is an internal portal.