Safa Marwah
A sophisticated cyber-espionage campaign has been uncovered, revealing how a threat actor, operating under the moniker Head Mare, has systematically breached TrueConf video conferencing servers to inject backdoors into client installers, thereby establishing a covert foothold within numerous high-value networks, primarily across the Russian Federation. This meticulously orchestrated supply chain attack capitalizes on critical vulnerabilities within the widely adopted TrueConf platform, a system frequently deployed by government agencies and large enterprises seeking secure, on-premises communication alternatives. The strategic compromise of this trusted communication software poses a significant and far-reaching security risk, allowing adversaries to distribute persistent malware through what would ordinarily be considered legitimate software updates.
The operational methodology employed by Head Mare demonstrates a high level of technical proficiency and strategic intent. The initial vector of compromise for TrueConf servers involved the exploitation of unpatched vulnerabilities, granting the attackers elevated privileges and arbitrary code execution capabilities. Cyber defense researchers meticulously tracked the group’s activities, pinpointing the exploitation of specific weaknesses within the TrueConf ecosystem. Notably, the attackers leveraged an open TCP port, 4307, which is configured by default on TrueConf servers, to establish an unauthenticated connection. This initial access point served as the gateway for further malicious activities, underscoring the critical importance of secure default configurations and proactive patch management.
Once initial access was secured, Head Mare proceeded to exploit a series of internal vulnerabilities, identified by security analysts as KLCERT-26-057 and KLCERT-26-058. The first vulnerability, KLCERT-26-057, allowed the execution of malicious scripts within TrueConf’s isolated runtime environment. This initial sandbox compromise was swiftly followed by the exploitation of KLCERT-26-058, which enabled a critical sandbox escape, providing the attackers with the ability to execute commands directly on the underlying operating system. This two-stage exploitation bypasses a fundamental security control designed to contain potential threats, illustrating the depth of the security flaws and the attackers’ ability to chain them effectively.
Following the successful sandbox escape, the threat actors engaged in privilege escalation, achieving the highly coveted NT AUTHORITYSYSTEM privileges. This level of access grants complete control over the compromised server, allowing for unhindered manipulation of system files and configurations. To ensure persistent access and control, Head Mare replaced a legitimate server file, specifically publicjslocale.php, with a custom web shell. This web shell serves as a covert communication channel, enabling continuous remote access to the compromised TrueConf server, even if other initial access methods are closed or detected. The establishment of such a persistent backdoor is a hallmark of sophisticated, long-term espionage operations.
With the server fully under their control, the attackers’ primary objective shifted to weaponizing the TrueConf update mechanism. Utilizing the web shell, Head Mare systematically exfiltrated sensitive information from the victim’s environment, accessed the TrueConf database, and, crucially, tampered with the legitimate TrueConf Client installer hosted on the server. The authentic installer was replaced with a malicious version, embedding the PhantomCore backdoor. This action represents a classic supply chain attack: users, trusting their internal TrueConf server, would download and execute what they believed to be a routine software update, inadvertently installing sophisticated malware onto their workstations. The absence of a digital signature on these trojanized installers should serve as a critical red flag, yet in many operational environments, such checks are not rigorously enforced or are bypassed by users accustomed to internal update processes.
The consequences of this trojanized installer distribution are profound. Any employee within an affected organization connecting to their local TrueConf server would receive this compromised client installer, thereby spreading the PhantomCore backdoor across the internal network. The ramifications extend beyond the immediate organization; security researchers have warned that even entities not directly using a TrueConf server internally could be at risk. Employees connecting to compromised TrueConf servers operated by third-party counterparties for online meetings could inadvertently download and install the infected client packages, effectively expanding the attack surface and creating a ripple effect across interconnected business ecosystems. This "counterparty risk" highlights the interconnectedness of modern digital infrastructure and the challenges of securing an extended enterprise.
Beyond PhantomCore, Head Mare also deployed PhantomGraph, a more advanced and distinct backdoor. PhantomGraph operates through two specific DLL files, SysExcSvc.dll and SysReadSvc.dll, demonstrating a modular approach to malware development. A particularly insidious feature of PhantomGraph is its command-and-control (C2) mechanism: it leverages Microsoft OneDrive accounts to receive commands and transmit results. Utilizing a legitimate, widely used cloud service like OneDrive for C2 significantly enhances the malware’s stealth, making it more challenging for traditional network security tools to detect and block malicious communications, as they blend seamlessly with legitimate cloud traffic.
Observed activities conducted via PhantomGraph reveal the group’s intelligence-gathering objectives. These activities included dumping the memory of the Local Security Authority Subsystem Service (LSASS) process, a critical operation aimed at extracting cached credentials, including usernames and passwords, from compromised systems. Such credentials are invaluable for lateral movement within a network, allowing attackers to access other systems and services without triggering further alerts. Furthermore, PhantomGraph executed reconnaissance commands such as hostname and whoami to map the network environment and identify user privileges. The establishment of reverse SSH tunnels also points to the attackers’ desire for robust, encrypted, and persistent remote access, capable of bypassing standard firewall rules.
Current intelligence indicates that Head Mare is actively engaged in multiple campaigns targeting a diverse array of Russian organizations. Sectors under attack include instrumentation, electronics, transportation, energy, information technology, and software development. This broad targeting suggests either a wide-ranging intelligence collection mandate or a desire for systemic disruption across critical national infrastructure and key economic sectors. The initial access methods employed by the threat actor are varied, encompassing phishing campaigns, the exploitation of other public-facing web servers, and gaining access through compromised third-party contractors. This multi-pronged approach underscores the adaptability and persistence of the threat actor, making defense against them particularly challenging.
The vulnerabilities at the core of these attacks affected TrueConf Server versions 5.3.x prior to 5.3.9, 5.4.x prior to 5.4.9, 5.5.x prior to 5.5.5, and all older versions. TrueConf, the vendor, addressed these critical flaws in security updates released on June 18, providing fixes in versions 5.3.9, 5.4.9, and 5.5.5. This timely patching is crucial, though the ongoing nature of the observed campaigns suggests that many organizations may not have applied these updates promptly, leaving them exposed.
This is not the first instance of TrueConf being targeted by sophisticated threat actors. A prior report from CheckPoint Research in April detailed a campaign dubbed "Operation True Chaos," which exploited a zero-day arbitrary file execution flaw in TrueConf, tracked as CVE-2026-3502. In that instance, attackers also compromised users via trojanized client updates, employing the Havoc implant. While tentatively attributed to Chinese threat actors, this historical context highlights a persistent pattern of advanced persistent threat (APT) groups focusing on the TrueConf platform, likely due to its strategic importance within its primary user base. The repeated targeting of TrueConf underscores its perceived value as a gateway into sensitive networks, making robust and continuous security enhancements absolutely paramount for the vendor and its user community.
The implications of such sophisticated supply chain attacks extend far beyond immediate data breaches or system compromise. They erode trust in critical software infrastructure, challenge the efficacy of traditional perimeter defenses, and necessitate a paradigm shift towards continuous verification and zero-trust architectures. For organizations utilizing TrueConf, immediate and thorough patching of all servers to the latest secure versions is non-negotiable. Beyond patching, implementing enhanced endpoint detection and response (EDR) solutions capable of identifying anomalous process behavior, such as LSASS memory dumps or the execution of unsigned binaries, is vital. Network segmentation can limit lateral movement, even if a host is compromised. Furthermore, rigorous supply chain security practices, including the verification of digital signatures on all software updates and the implementation of robust vulnerability management programs, are essential. User awareness training regarding suspicious updates and the risks associated with connecting to external, potentially compromised, communication platforms also forms a critical layer of defense.
Looking ahead, the landscape of cyber warfare and espionage will undoubtedly see a continued focus on supply chain compromises. As organizations harden their direct defenses, adversaries will increasingly seek to exploit weaknesses in the software and services they rely upon. The use of legitimate cloud services for command and control, as seen with PhantomGraph’s use of OneDrive, exemplifies the evolving tactics designed to evade detection. For software vendors like TrueConf, this necessitates not only rapid vulnerability remediation but also a proactive security-by-design approach, continuous security auditing, and fostering strong collaboration with the cybersecurity research community to identify and neutralize threats before they can be exploited. The ongoing vigilance and adaptive defense strategies are crucial to counter the persistent and evolving threats posed by groups like Head Mare.
Lisa Mariana
Aura Kasih
Ayu Aulia
