In July 2026, Kaspersky experts detected a new attack by the Head Mare group that used a chain of vulnerabilities in unpatched TrueConf servers to replace legitimate client installers with infected versions and distribute a backdoor to meeting participants.
How Head Mare exploited TrueConf servers (KLCERT-26-057, KLCERT-26-058)
Kaspersky’s investigation shows the intrusion begins with unauthenticated access to TrueConf server listening on port 4307/TCP, which the product documentation states is open by default. The campaign affects TrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, and 5.5.X through 5.5.5. Attackers call a server function to deliver and execute a malicious script (internal identifier KLCERT-26-057). That script runs in an isolated TrueConf scripting environment; the attackers then exploit a second vulnerability (KLCERT-26-058) to escape the sandbox, obtain operating-system command execution and elevate to NT AUTHORITY\SYSTEM. With SYSTEM privileges they replaced …\public\js\locale.php with a web shell to retain control and proceed with follow‑on actions.
PhantomCore and PhantomGraph: payloads, persistence and C2
Using the web shell, the attackers obtained privileged access to the TrueConf database and swapped the original TrueConf Client distribution for an infected installer containing the PhantomCore backdoor. Kaspersky reports PhantomCore was detected by their solutions and that the attackers established persistence by creating a registry key:
- HKEY_CURRENT_USER\Software\Classes\CLSID\{{0340F119-A598-4ed9-B0AC-6F6A12D3E755}}\InprocServer32 — value set to the malicious file path.
In addition to PhantomCore, the attackers deployed a second backdoor family Kaspersky calls PhantomGraph, composed of two modules: SysExcSvc.dll (receives commands and returns results) and SysReadSvc.dll (reads commands, executes them, saves results). The actors used a Microsoft OneDrive account as command-and-control for PhantomGraph. To persist these components they executed a Base64-encoded PowerShell command that installed SysExcSvc.dll and SysReadSvc.dll as Windows services; Kaspersky notes the command was split into two components, apparently to hinder EDR detection.
Kaspersky extracted commands run through the backdoor chain, including reconnaissance commands (hostname; whoami), attempts to create a memory dump of lsass.exe, and launching an SSH reverse tunnel. The report also notes several commands failed due to typos and encoding errors.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadIndicators of compromise published by Kaspersky
Kaspersky published hashes, IPs, domains, service names and file paths tied to the activity. Examples from the report include:
- Web shell MD5: 4d27b4eb1c5dbb3d8160f29b8119523e (locale.php)
- Infected installer MD5: 748c9f8cb1065000616204935f96207f (trueconf_windows_update.exe)
- PhantomCore DLL MD5: c5a460e4e68a088f6e51b2c6474642ec
- PhantomGraph DLLs: 489f43be558b2679284ceabed7adc4f3 (sysexcsvc.dll), dd1fd2b459b97b7d59375cb8383cd19a (sysreadsvc.dll)
- Noted IPs: 81.177.32[.]12, 194.87.239[.]71, 194.87.93[.]153 (ssh), 38.244.205[.]244, 31.59.102[.]61
- Observed domains: penzadogshelter[.]site, trendy-market[.]site, bright-deals[.]site, nova-stream[.]site, and others
- Windows service names: SysExcSvc, SysReadSvc
- Key file paths: C:\Windows\System32\inetsrv\SysExcSvc.dll, %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll, /etc/systemd/system/omicluster.service
Detection, hunting rules and vendor mitigations from Kaspersky
Kaspersky reports their products detect and block the activity with multiple signatures and rules. Detection names include Backdoor.PHP.WebShell.abi, Backdoor.Win64.PhantomCore.dt, Trojan.Win64.PhantomGraph.gen and several HEUR detections. Kaspersky Endpoint Detection and Response Expert (KEDR Expert) flags the replacement of …\public\js\locale.php via the rule unusual_php_file_creation_from_trueconf_process and detects unsigned client installers with the unsigned_trueconf_installer rule.
The Kaspersky Managed Detection and Response service watches for suspicious file creation by TrueConf processes, execution of unsigned installers, suspicious process chains tied to TrueConf update executables, registration of libraries under the CLSID registry key noted above, and activity involving lsass.exe memory access and dump via comsvcs.dll. For SIEM and hunting, Kaspersky provides rules for file writes to IIS native modules directories, lsass dumps via comsvcs.dll, and suspicious access to LSASS. They advise ensuring collection of full Windows Security events (4688, 4663, 4657, 4697) and Sysmon events (1, 7, 11, 13) for detection rules to work correctly.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Verify servers are running patched TrueConf Server versions 5.3.9, 5.4.9 or 5.5.5 (updates released June 18, 2026), ensure logging (Security and Sysmon) is comprehensive, and apply the Kaspersky detection rules and YARA signatures provided where relevant.
- Affected enterprises in Russia’s instrument manufacturing, electronics, transportation, energy, IT and software development sectors: Audit any TrueConf servers and confirm client distribution files served locally bear a valid TrueConf digital signature; Kaspersky notes the malicious distributions they found lacked a valid signature.
- End users and business partners: Kaspersky warns — “Important: Even if your organization does not use a TrueConf server, your employees may connect to compromised TrueConf servers belonging to business partners” and download infected installers. Verify download authenticity on the vendor’s website rather than relying solely on a meeting host’s server.
Kaspersky says the vendor patched the exploited vulnerabilities in TrueConf Server updates released on June 18, 2026, and that a fuller technical description of the exploitation mechanism will be published on the Kaspersky ICS CERT website. For the advisory and full indicator list, see the original Kaspersky writeup linked below.
https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/
