Head Mare Hackers Trojanize TrueConf Server Installers to Deploy Backdoors

Unpatched instances of TrueConf Server are actively being compromised by the pro-Ukrainian hacktivist collective known as Head Mare, who are chaining unauthenticated remote code execution flaws to trojanize client installers with backdoors. By replacing legitimate client installation packages on compromised video conferencing servers, the group effectively turns an organization’s internal collaboration platform into a malware distribution hub. The campaign highlights the ongoing threat of localized software supply-chain attacks, where threat actors turn trusted on-premise infrastructure into infection vectors for internal users and connected business counterparties.

Exploitation Mechanics: Unauthenticated Access and Sandbox Escapes

The initial compromise vector relies on chaining two flaws in TrueConf Server tracked internally by Kaspersky as KLCERT-26-057 and KLCERT-26-058. Head Mare operators scan for exposed servers over TCP port 4307, which is open by default on TrueConf deployments to handle client-server traffic.

Because TCP port 4307 allows connections without authentication, the attackers leverage KLCERT-26-057 to execute arbitrary scripts within TrueConf’s isolated sandbox environment. From there, they trigger KLCERT-26-058, a sandbox escape vulnerability that grants direct command execution on the underlying operating system.

Once OS-level command execution is achieved, the threat actors elevate privileges to NT AUTHORITY\SYSTEM. To secure persistent access, Head Mare overwrites the legitimate server file \public\js\locale.php with a PHP web shell. This shell provides full remote administration capabilities over the server, enabling the operators to query the underlying TrueConf backend database, exfiltrate sensitive environment data, and modify hosted static files.

Trojanizing Client Installers and Deploying Malware

With administrative control over the server host, the attackers execute the primary phase of the campaign: replacing the official TrueConf Client installer stored on the server’s public web directory with a trojanized version containing the PhantomCore backdoor.

When internal employees or external contractors connect to the compromised TrueConf server to join meetings or update their client software, the server pushes the trojanized installer. Although functional, the malicious package lacks a valid digital signature. Because end users expect update prompts from their enterprise conferencing software, execution rates for these modified installers are exceptionally high.

Simultaneously, Head Mare deploys a secondary custom backdoor called PhantomGraph onto target environments. PhantomGraph consists of two dynamic link libraries (DLLs):

• SysExcSvc.dll
• SysReadSvc.dll

PhantomGraph abuses Microsoft OneDrive accounts for command-and-control (C2) communication, using cloud storage API endpoints to receive operator commands and exfiltrate stolen data. Using this pipeline, Head Mare conducts host reconnaissance via standard command-line utilities (hostname, whoami), dumps Local Security Authority Subsystem Service (LSASS) process memory to harvest user credentials, and initiates reverse SSH tunnels to enable lateral movement across the internal network.

Targeted Sectors and Blast Radius

TrueConf is widely deployed across enterprise, energy, and government organizations in Russia as an on-premise alternative to Western conferencing platforms like Zoom and Microsoft Teams. Compromising a central conferencing server provides attackers with direct, elevated access into sensitive corporate networks.

Kaspersky reports that Head Mare is operating active campaigns against Russian entities across multiple sectors, including electronics, instrumentation, energy, transportation, IT, and software development. In addition to server exploitation, the group uses phishing, compromised contractor access, and exposed web applications to gain initial footprints.

The blast radius extends beyond the initial victim organization. When third-party partners or clients join a video call hosted on a compromised TrueConf server, they are frequently prompted to download or update the client binary to connect. As a result, a single unpatched TrueConf server can infect external partner organizations, bridging perimeter defenses without requiring direct compromise of the counterparty’s network.

This campaign follows earlier targeting of TrueConf infrastructure documented in April 2026 by CheckPoint Research. That activity, dubbed “Operation True Chaos,” saw Chinese threat actors exploit a zero-day arbitrary file execution flaw (CVE-2026-3502) in TrueConf to deliver the Havoc post-exploitation implant via malicious client updates.

Mitigation and Technical Guidance

Organizations running TrueConf Server must immediately verify that their instances are patched and inspect existing server files and client endpoints for signs of compromise.

1. Apply Software Patches: TrueConf patched KLCERT-26-057 and KLCERT-26-058 on June 18. Server administrators must update installations to TrueConf Server 5.3.9, 5.4.9, 5.5.5, or higher.
2. Inspect Server Web Root: Audit TrueConf server directories for unauthorized modifications, specifically checking \public\js\locale.php for web shell code and verifying the hash integrity of hosted client installer executables.
3. Enforce Digital Signature Validation: Configure endpoint protection rules to block the installation of unsigned executables. Legitimate TrueConf client packages carry valid digital signatures from the vendor.
4. Monitor for Indicators of Compromise:
   • Search endpoint environments for SysExcSvc.dll and SysReadSvc.dll.
   • Monitor outbound traffic from server hosts for unexpected connections to Microsoft OneDrive API endpoints or unauthorized SSH tunneling activity.
   • Audit LSASS process memory access attempts on high-value hosts.
5. Network Access Controls: Restrict external access to TCP port 4307 using firewalls or limit server management interfaces to authorized internal network segments and VPNs.