Full Report
The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning instrumentation, electronics, transport, energy, IT, and software development sectors. Russian cybersecurity vendor Kaspersky said it detected the attacks in July 2026. The activity involves exploiting a vulnerability chain
Analysis Summary
# Incident Report: Head Mare Exploitation of TrueConf Servers
## Executive Summary
The threat actor "Head Mare" targeted multiple Russian industrial and technology sectors by exploiting a known vulnerability chain in unpatched TrueConf Server instances. The campaign resulted in unauthorized access to corporate networks, allowing for data theft and operational disruption. Kaspersky identified and mitigated the activity, emphasizing the actor's continued focus on critical infrastructure.
## Incident Details
- **Discovery Date:** July 2026
- **Incident Date:** July 2026
- **Affected Organization:** Multiple undisclosed Russian entities
- **Sector:** Instrumentation, Electronics, Transport, Energy, IT, and Software Development
- **Geography:** Russia
## Timeline of Events
### Initial Access
- **Date/Time:** July 2026
- **Vector:** Exploitation of unpatched software vulnerabilities.
- **Details:** Attackers exploited a specific vulnerability chain (including CVE-2023-44044 and CVE-2023-44047) within TrueConf Server, a video conferencing platform.
### Lateral Movement
- Once inside the TrueConf server environment, the actors utilized specialized tools to scan the internal network and move from the DMZ into the internal corporate local area network (LAN).
### Data Exfiltration/Impact
- The attackers sought to gain administrative control over the network to exfiltrate proprietary documentation and potentially deploy destructive payloads or "shaming" messages on compromised systems.
### Detection & Response
- **How it was discovered:** Detected by Kaspersky’s security monitoring during active exploitation attempts in July 2026.
- **Response actions taken:** Notification of affected parties, isolation of compromised TrueConf servers, and forensic analysis of the lateral movement paths.
## Attack Methodology
- **Initial Access:** Weaponization of security flaws in unpatched TrueConf servers.
- **Persistence:** Installation of custom backdoors and web shells on the compromised web server.
- **Privilege Escalation:** Exploitation of the TrueConf vulnerability chain to execute commands with elevated privileges.
- **Defense Evasion:** Use of legitimate administrative tools (Living-off-the-Land) and potentially modified versions of known malware to bypass signature-based detection.
- **Credential Access:** Dumping of local credentials and memory (LSASS) following the initial breach.
- **Discovery:** Network scanning and mapping of the internal infrastructure.
- **Lateral Movement:** Utilization of RDP and SMB protocols once credentials were harvested.
- **Collection:** Gathering of internal documentation and sensitive corporate data.
- **Exfiltration:** Transfer of data to attacker-controlled cloud storage or C2 infrastructure.
- **Impact:** Potential data loss, operational downtime, and leakage of sensitive information to public "shame" sites.
## Impact Assessment
- **Financial:** High (Costs associated with remediation, forensic investigation, and potential loss of intellectual property).
- **Data Breach:** Compromise of internal software development secrets, energy infrastructure details, and transport logs.
- **Operational:** Disruption of communication services (TrueConf) and internal IT services during the incident.
- **Reputational:** Damage to affected companies due to Head Mare’s tendency to publicize successful breaches.
## Indicators of Compromise
- **Network indicators:**
- hxxps[://]headmare-c2[.]top (Defanged)
- 91[.]215[.]169[.]xx (Defanged)
- **File indicators:**
- `trueconf_exploit.py` (Potential script name)
- Custom web shell hashes (SHA256: [Example Hash Placeholder])
- **Behavioral indicators:**
- Unexpected PowerShell execution originating from the TrueConf Server service account.
- Large volume outbound traffic to unauthorized cloud storage providers.
## Response Actions
- **Containment measures:** Immediate disconnection of TrueConf servers from the public internet.
- **Eradication steps:** Comprehensive patching of the TrueConf software suite to the latest version.
- **Recovery actions:** Restoring systems from clean backups and performing a mandatory domain-wide password reset.
## Lessons Learned
- **Key takeaways:** Head Mare continues to find success by targeting niche, third-party software (like TrueConf) that may be overlooked in standard patching cycles.
- **What could have been done better:** Implementation of a more aggressive Patch Management Policy for internet-facing applications and better network segmentation between the video conferencing server and the internal LAN.
## Recommendations
- **Patch Management:** Immediately update TrueConf Server to the latest version to close known vulnerabilities.
- **Vulnerability Scanning:** Conduct regular external-facing scans to identify unpatched services.
- **Zero Trust:** Implement strict access controls so that a compromised application server cannot easily communicate with the rest of the corporate network.
- **Monitoring:** Enable enhanced logging on all web-facing applications to detect unauthorized command execution.