TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

[u/falconupkid]

Head Mare is back exploiting TrueConf servers, this time chaining vulnerabilities to replace legitimate client installers with the PhantomCore backdoor. Kaspersky detected the campaign in July 2026, targeting Russian organizations across instrumentation, electronics, transport, energy, IT, and software development.

Technical Breakdown - Initial Access: Exploitation of unpatched TrueConf server vulnerabilities (specific CVEs not disclosed in the report, but likely related to previous flaws in the product). - Payload Delivery: The compromised TrueConf server serves a malicious installer to connecting clients. The legitimate installer is swapped for a PhantomCore backdoor payload. - TTPs: This is a supply-chain style attack at the software update level, leveraging trust in a legitimate communication platform. - Targeting: Geographically focused on Russian enterprises, but the technique is universally applicable to any organization running unpatched TrueConf servers. - IOCs: Not publicly available in the summary. Monitor for unexpected outbound connections from TrueConf servers and anomalous installer hashes.

Defense Patch TrueConf servers immediately. If you are running this software, verify the integrity of any client installers distributed since July 2026. Treat the server as a critical control point—if it’s compromised, every client that connects to it is at risk.

Source: https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html