Head Mare Trojanizes TrueConf Server Installers to Deploy Backdoors

Overview

On-premise video conferencing platforms have become prime targets for threat actors seeking high-leverage entry points into corporate and government networks. The pro-Ukrainian hacktivist group known as Head Mare has been actively breaching unpatched installations of TrueConf Server, a widely used self-hosted communications platform in Russia and Eastern Europe.

By leveraging a pair of severe TrueConf server vulnerabilities, the attackers execute arbitrary code on vulnerable servers, establish administrative persistence, and replace legitimate client software installers hosted on the server with trojanized binaries. This supply-chain technique allows Head Mare to automatically deliver backdoors—dubbed PhantomCore and PhantomGraph—to employees within targeted organizations, as well as external counterparties joining hosted conference sessions.

Kaspersky researchers initially identified the campaign in July, observing active targeting across a wide swath of Russian enterprise sectors, including energy, electronics, transportation, IT, software development, and precision instrumentation.

How the TrueConf Server Vulnerabilities Are Exploited

TrueConf Server relies on several listening ports for client connections, media streaming, and administrative signaling. By default, TCP port 4307 is open to accept unauthenticated network connections from clients attempting to join video sessions or query server states. Head Mare uses this open port as their initial entry point.

The exploit chain relies on two flaws discovered by security researchers:

• Unauthenticated Isolated Execution (KLCERT-26-057): The attacker sends crafted requests over TCP port 4307 to trigger script execution within TrueConf’s isolated execution environment without presenting valid credentials.
• Sandbox Escape & Privilege Escalation (KLCERT-26-058): Once code execution is established in the sandbox, the attacker exploits a secondary flaw to escape the restricted environment and execute arbitrary operating system commands directly on the host underlying system.

After breaking out of the application sandbox, the attackers escalate privileges to NT AUTHORITY\SYSTEM—the highest administrative tier on Windows host platforms. To secure persistent access, Head Mare overwrites the local \public\js\locale.php web file on the server with a custom web shell. This web shell serves as a command-and-control bridge, allowing the group to query backend TrueConf databases, run system diagnostics, and modify filesystem contents at will.

Malware Delivery and Post-Exploitation Activity

Once full control over the TrueConf server is established, Head Mare pivots from server compromise to client distribution hijacking. The web shell is used to locate the legitimate TrueConf Client installer binary hosted on the web interface and swap it with a malicious, non-digitally signed installer package containing the PhantomCore backdoor.

When internal employees or external meeting participants connect to the compromised server, the application prompts or serves the trojanized client installer under the guise of a routine software update or required client download. Because users inherently trust their organization’s internal meeting server—or the server of a trusted business partner—they execute the installer without scrutiny.

In addition to PhantomCore, Head Mare deploys a second specialized malware family known as PhantomGraph. This backdoor relies on two dynamic link libraries (DLLs):

• SysExcSvc.dll
• SysReadSvc.dll

PhantomGraph is notable for using Microsoft OneDrive API endpoints as its command-and-control channel. By routing traffic through legitimate cloud infrastructure, the malware easily bypasses conventional perimeter firewall rules and egress filtering. The backdoor accepts remote commands to dump the memory of the Local Security Authority Subsystem Service (lsass.exe) to harvest domain credentials, perform host reconnaissance via basic utility commands (whoami, hostname), and initiate reverse SSH tunnels for direct interactive access.

This is not the first time TrueConf’s updater architecture has been subverted. In April 2026, CheckPoint Research uncovered “Operation True Chaos,” where advanced actors leveraged a zero-day arbitrary file execution flaw (CVE-2026-3502) in TrueConf to deliver the Havoc post-exploitation framework via altered update flows. Head Mare’s current activities show that client installer replacement remains a reliable, repeatable vector against unpatched communications software.

The Extended Blast Radius: Counterparty Risk

The operational impact of this attack model extends far beyond the immediate server owner. In modern enterprise environments, self-hosted meeting platforms like TrueConf operate under an implicit trust model: external guests routinely download transient client packages or run automatic updates when joining calls hosted by third-party vendors, suppliers, or government entities.

If an organization patches its own internal TrueConf infrastructure but its contractors or counterparties fail to do so, employees joining external meetings hosted on those unpatched counterparty servers are exposed to the exact same trojanized installer packages. This creates a lateral supply-chain blast radius where a single compromised vendor server can infect dozens of partner organizations across different economic sectors.

Required Patching and Remediation Steps

TrueConf addressed both underlying server flaws in maintenance updates released on June 18. System administrators managing TrueConf Server must immediately inspect their current build versions and patch accordingly:

• TrueConf Server 5.3.x: Upgrade to version 5.3.9 or later.
• TrueConf Server 5.4.x: Upgrade to version 5.4.9 or later.
• TrueConf Server 5.5.x: Upgrade to version 5.5.5 or later.

Security teams should specifically audit the TrueConf root directory for unauthorized modifications to \public\js\locale.php and verify the cryptographic signatures of all client installer binaries hosted on their public-facing web portals. Endpoint detection rules should monitor for unsigned executables spawning from TrueConf client installation paths, as well as unexpected calls to Microsoft OneDrive API subdomains originating from system services like SysExcSvc.dll and SysReadSvc.dll.