Head Mare Weaponizes TrueConf Flaws to Spread PhantomCore Backdoor
The Russia-linked threat actor Head Mare has resurfaced with a new campaign exploiting security flaws in unpatched TrueConf videoconferencing servers to deliver the PhantomCore backdoor and remote access trojan (RAT) into Russian organizations. Detected by Kaspersky in July 2026, the attacks span critical sectors including instrumentation, electronics, transport, energy, IT, and software development.
The intrusion chain chains two vulnerabilities — KLCERT-26-057 and KLCERT-26-058 — to achieve arbitrary code execution with NT AUTHORITY\SYSTEM privileges. Attackers initially connect to the TrueConf server over TCP port 4307, which is open by default, then leverage KLCERT-26-057 to execute a malicious script inside the server's isolated environment. They subsequently exploit KLCERT-26-058 to escape that sandbox and run arbitrary commands on the underlying host. Once entrenched, the operators replace the file "...\public\js\locale.php" with a web shell granting persistent remote access, allowing them to harvest IT infrastructure data, reach the TrueConf database with elevated rights, and ultimately swap the legitimate TrueConf Client installer with a trojanized variant carrying PhantomCore. Security teams can use a port scanner to verify whether TCP 4307 and other administrative endpoints are exposed to the public internet.
The attack extends beyond PhantomCore. The same web shell acts as a staging conduit for a second backdoor dubbed PhantomGraph, which exhibits code-level overlap with PhantomCore and ships two DLL modules: "SysExcSvc.dll," tasked with receiving commands and exfiltrating results to a Microsoft OneDrive account used as command-and-control infrastructure, and "SysReadSvc.dll," responsible for parsing and executing those commands. Persistence is achieved through a Base64-encoded PowerShell payload that installs the DLLs as Windows services — a deliberate split, according to Kaspersky, designed to evade EDR detection. Operators have additionally been observed launching SSH reverse tunnels, dumping the memory of "lsass.exe" for credential harvesting, and running reconnaissance commands such as hostname and whoami. Users and administrators should pair these defenses with credential hygiene, starting by running any privileged passwords through a password checker to confirm they have not appeared in known breaches.
TrueConf has patched the flaws in versions 5.3.9, 5.4.9, and 5.5.5, released on June 18, 2026. The vulnerabilities impact TrueConf Server 5.3.x up to 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and all earlier builds. Organizations running affected deployments should upgrade immediately, audit their servers for indicators of compromise tied to PhantomCore and PhantomGraph, and run a broader privacy checkup to ensure exposure across the rest of their attack surface does not provide attackers with additional footholds.