Head Mare Hacktivists Breach TrueConf to Trojanize Client Installers with PhantomCore Backdoors

Supply Chain Compromise via Trojanized Video Conferencing Installers

The Head Mare hacktivist group has been discovered exploiting unpatched vulnerabilities in TrueConf Server to replace legitimate client installers with trojanized versions that deliver two backdoors: PhantomCore and PhantomGraph. Organizations that downloaded TrueConf client updates from their internal servers received malware instead of legitimate software, creating persistent footholds across their networks.

Kaspersky researchers disclosed the campaign on August 8, 2026, identifying active exploitation targeting Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development sectors.

How the Attack Works

Initial Compromise

Head Mare gained initial access by targeting TCP port 4307, which TrueConf Server leaves open by default and which lacked authentication controls. Through this port, attackers exploited two vulnerabilities:

By chaining these two flaws, attackers escalated from the TrueConf application sandbox to full system-level access on the server.

Establishing Persistence

With system-level access, attackers replaced the /public/js/locale.php file with a web shell, granting persistent remote access that survived reboots and service restarts. This web shell served as the staging point for installer manipulation.

Trojanizing the Installers

Legitimate TrueConf client update packages distributed by the compromised server were replaced with trojanized installers. Any client that connected to update would download and execute malware alongside — or instead of — the legitimate software.

Malware Deployed

PhantomCore

An initial-access backdoor embedded directly in the trojanized client installer packages. PhantomCore establishes a foothold on victim endpoints, enabling the attackers to deploy additional payloads.

PhantomGraph

A more sophisticated two-component backdoor consisting of:

PhantomGraph accepts commands via Microsoft OneDrive accounts, using the cloud storage service as a covert command-and-control (C2) channel to blend with legitimate corporate traffic. Capabilities include:

• Credential harvesting — captures stored credentials from browsers and applications
• Reconnaissance — system enumeration, network mapping, and data staging
• Persistence — registers as a service to survive system reboots

Affected Versions

TrueConf released patches on June 18, 2026. The public disclosure and Kaspersky research dropped on August 8, 2026.

Campaign Context

Head Mare has been an active threat actor targeting Russian organizations since at least 2024. This campaign follows a prior zero-day exploitation chain (CVE-2026-3502) used in "Operation True Chaos" in April 2026, also targeting TrueConf infrastructure.

The group's targeting pattern spans organizations in:

• Instrumentation and electronics manufacturing
• Transportation and logistics
• Energy sector
• IT and software development companies

The use of OneDrive as a C2 channel is a deliberate evasion tactic, as Microsoft cloud traffic is rarely blocked or closely inspected in enterprise environments.

Immediate Actions

For TrueConf Administrators

1. Update TrueConf Server immediately to the patched version for your branch (5.3.9, 5.4.9, or 5.5.5)
2. Audit installer files — compare hashes against vendor-provided legitimate packages
3. Examine /public/js/locale.php for web shell content
4. Block TCP port 4307 from internet exposure if not required externally
5. Review server access logs for anomalous activity since April 2026

For Organizations that Downloaded TrueConf Installers

If your TrueConf server was not patched before June 18, 2026,
treat any client installations or updates as potentially compromised.

1. Isolate and scan endpoints that received TrueConf updates between April–June 2026
2. Hunt for PhantomCore/PhantomGraph indicators (see below)
3. Audit OneDrive access logs for unusual account activity or API calls
4. Rotate credentials — particularly any stored in browsers on affected systems

Indicators of Compromise

Broader Lessons: Supply Chain and Update Security

The TrueConf campaign highlights a recurring theme in modern threat actor playbooks: compromise the distribution mechanism, not just the endpoint. When update servers are trojanized, traditional endpoint defenses offer little protection — the malware arrives signed and packaged as legitimate software.

Key mitigations for organizations running internal software distribution:

• Verify installer hashes against vendor-published checksums before deployment
• Segment update infrastructure — isolate software distribution servers from general network access
• Monitor outbound cloud traffic for unusual OneDrive/SharePoint API patterns
• Zero-trust software updates — treat every update as potentially hostile until verified

References

• BleepingComputer — Hackers Breach TrueConf to Trojanize Client Installers
• Kaspersky — Head Mare Campaign Analysis
• TrueConf Security Advisory — Patches 5.3.9, 5.4.9, 5.5.5

Related Reading

• New CSS Attacks Break Webmail Defenses to Steal Passwords and Tokens
• CVE-2026-19264: Critical Path Traversal in Postiz