CISA: Head Mare Hacktivists Actively Exploiting TrueConf Server Flaws

Federal agencies were put on alert this week after the US Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities in TrueConf Server to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-72529 and CVE-2026-72530, both flaws affect all TrueConf Server versions released since 2022 and allow remote attackers to execute arbitrary code through port 4307/TCP. The bugs were addressed in June 2026 in versions 5.3.9, 5.4.9, and 5.5.5, but ongoing in-the-wild exploitation prompted CISA to mandate patching within three days for federal agencies, while the second flaw carries a standard two-week remediation deadline.

Security researchers at Kaspersky linked the active exploitation to Head Mare, a hacktivist group operating since at least 2023 that has historically targeted organizations in Russia and Belarus. The attackers leveraged CVE-2026-72529 to call an undocumented function and execute arbitrary scripts, then chained it with CVE-2026-72530 to escape the isolated environment and run scripts directly on the host operating system. After gaining a foothold, the threat actors replaced a legitimate file with a web shell, which they used to gather intelligence on the victim's IT infrastructure, access the TrueConf Server database, and swap legitimate client installers with trojanized versions. These malicious installers delivered PhantomCore, a malware family closely associated with Head Mare's destructive operations.

Head Mare's tradecraft included deploying two distinct backdoors on Unix-based TrueConf servers. One uses the TrueConf protocol for command-and-control communications, while a second variant leverages GitHub as a covert C2 channel. The group is not financially motivated despite deploying file-encrypting malware and demanding ransoms; instead, it appears focused on disruption, espionage, and data destruction. Organizations running TrueConf on internet-exposed infrastructure should verify their server version immediately and use a port scanner to confirm whether port 4307/TCP is reachable from outside the perimeter.

TrueConf administrators are urged to upgrade to a patched release, audit their environments for indicators of compromise, and rotate all potentially affected credentials without delay. Given the credential theft and lateral movement angle of these attacks, security teams should run a password checker to identify weak or reused credentials, and use a email breach checker to confirm whether administrator accounts appear in known credential dumps. Affected organizations should also review every client installer file served from their TrueConf server for tampering before further internal distribution.