Full Report
Ukrainian hacktivists exploiting the bugs, but TrueConf's reach stretches well beyond home turf
Analysis Summary
# Vulnerability: Critical TrueConf Server Chain Exploited for Malware Delivery
## CVE Details
- **CVE ID:** CVE-2026-72529 and CVE-2026-72530
- **CVSS Score:** Not explicitly listed in text (CISA KEV addition implies high/critical severity)
- **CWE:** Not specified (Involves Sandbox Escape and Remote Code Execution)
## Affected Systems
- **Products:** TrueConf Server (On-premises video conferencing platform)
- **Versions:** Releases dating back to 2022; specifically those prior to versions 5.3.9, 5.4.9, and 5.5.5.
- **Configurations:** Systems with TCP port 4307 open (default configuration).
## Vulnerability Description
This is a two-stage exploit chain:
1. **CVE-2026-72529:** Allows an unauthenticated attacker with network access to the TrueConf service (TCP port 4307) to execute a malicious script within an isolated environment.
2. **CVE-2026-72530:** A sandbox escape flaw that allows the attacker to break out of the isolated script environment to execute arbitrary code on the underlying host server.
## Exploitation
- **Status:** Exploited in the wild (Confirmed by CISA and Kaspersky). Linked to pro-Ukrainian group "Head Mare."
- **Complexity:** Low/Medium (Exploits default ports and unauthenticated access).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Full access to TrueConf database and underlying server files).
- **Integrity:** High (Attackers replaced legitimate Windows client installers with trojanized versions).
- **Availability:** High (Full server compromise).
- **Lateral Movement:** Significant; used to deliver **PhantomCore** malware to meeting participants via trojanized installers.
## Remediation
### Patches
Update TrueConf Server to the following versions (released June 18, 2026) or newer:
- **Version 5.3.9**
- **Version 5.4.9**
- **Version 5.5.5**
### Workarounds
- **Network Segmentation:** Ensure TCP port 4307 is not exposed to the public internet. Restrict access to known internal IP ranges only.
- **Installer Verification:** Manually verify the checksums/signatures of TrueConf client installers before distribution to employees.
## Detection
- **Indicators of Compromise:**
- Presence of the **PhantomCore** backdoor.
- Unauthorized web shells on the TrueConf Server.
- Unexpected modifications to the TrueConf database or the Windows client installer file on the server.
- **Detection Methods:** Monitor traffic on **TCP port 4307** for anomalous scripting activity. Audit server file integrity, specifically the directory containing client download packages.
## References
- CISA Known Exploited Vulnerabilities Catalog: [https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
- Kaspersky ICS-CERT Report: [https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware/]
- Vendor Website: [https://trueconf.com]