Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants

Overview of the attack In July 2026, Kaspersky experts detected a new attack by the Head Mare group. Previously, we classified them as hacktivists, but now we define them as an APT group due to the sophistication of their TTPs and the absence of destructive activity (encryption, wiping) in the targeted infrastructures. In this latest campaign, the attackers exploited a chain of vulnerabilities in the TrueConf video conferencing server and replaced the original TrueConf client installers with infected versions that installed the PhantomCore malware on the system. An investigation of the compromised server revealed that the attackers used a combination of two new vulnerabilities (assigned internal identifiers KLCERT-26-057 and KLCERT-26-058), allowing them to execute arbitrary code with the highest privileges. The attack occurs in several stages: - The attackers connect to the TrueConf server without prior authorization via port 4307/TCP, which, according to the product documentation, is open by default. The attack affects TrueConf servers running versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, and 5.5.X through 5.5.5. - Once connected, attackers call a server function to transmit a malicious script and execute it on the server. The vulnerability that allows this stage of the attack to be carried out has been assigned the internal identifier KLCERT-26-057. - The received script runs on the TrueConf server in an isolated environment. By default, operating system functions are not accessible in this environment, which should limit the capabilities of the executed code. - To escape the isolated environment, attackers exploit a second vulnerability, assigned the internal identifier KLCERT-26-058. Exploiting this vulnerability allows them to bypass the restrictions of the isolated environment and proceed to execute commands in the context of the operating system. - Once the environment’s restrictions are bypassed, attackers gain the ability to execute arbitrary code on the server with the privileges of the NT AUTHORITY\SYSTEM account. - Once they have gained elevated privileges, attackers replace the file …\public\js\locale.php with a web shell, which can be used for subsequent remote control of the compromised server. This web shell was used for the following activities: - collecting data about the IT infrastructure; - gaining privileged access to the TrueConf database; - replacing the original TrueConf Client distribution with an infected version containing the PhantomCore backdoor. The vulnerabilities exploited by the attackers were patched by the vendor in the latest TrueConf Server updates (versions 5.3.9, 5.4.9, and 5.5.5). These updates were released on June 18, 2026. The PhantomCore backdoor was successfully detected by Kaspersky solutions. To automatically launch the malware after the system boots, a registry key is created: HKEY_CURRENT_USER\Software\Classes\CLSID{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32, with the value set to the path to the malicious program’s file. Using a web shell, in addition to PhantomCore, the attackers load a backdoor that we have named PhantomGraph, consisting of two modules: SysExcSvc.dll is responsible for receiving commands from the attackers and transmitting the results of their execution. The attackers used an account on Microsoft OneDrive cloud storage as their command-and-control (C2) server.SysReadSvc.dll reads the command transmitted by the first module, executes it, and saves the execution result. To establish persistence on the system, the attackers execute a Base64-encoded PowerShell command that installs SysExcSvc.dll and SysReadSvc.dll as Windows services. We believe the attackers deliberately split this malicious command into two components to make it harder to detect using EDR tools. Additionally, the program’s code partially matches that of PhantomCore, indicating that it belongs to the Head Mare group’s arsenal. We also managed to identify the commands executed by the attackers when connecting to the backdoor. The SysReadSvc module executes commands using a BATCH file. Example of execution: | 1 | $system32\cmd.exe /c cmd /c ""$temp\cmd_cmd_4488.bat"" 2>&1 | Commands detected: - Memory dump of the lsass.exe process: - Reconnaissance of the user and system names: | 1 2 3 4 5 | hostname whoami "$system32\WindowsPowerShell\v1.0\powershell.exe" -noexit -command Set-Location -literalPath '$system32\inetsrv' | - Launching an SSH reverse tunnel: In addition, we discovered several commands that did not work due to the attackers’ typos and encoding issues. We are observing several active Head Mare campaigns targeting Russian organizations across various industries: instrument manufacturing, electronics, transportation, energy, IT, and software development. The attackers distribute their backdoors using various methods, including phishing, exploiting public web servers, or through a subcontractor. We recommend that all organizations using TrueConf software install the latest server version (versions 5.3.9, 5.4.9, and 5.5.5) in accordance with the vendor’s recommendations. We also recommend verifying that the client distributions downloaded from the TrueConf server used by your organization have a valid TrueConf digital signature and have not been tampered with. The malicious distributions we detected do not have a valid digital signature. You can also verify authenticity on the vendor’s website. Important: Even if your organization does not use a TrueConf server, your employees may connect to compromised TrueConf servers belonging to business partners to participate in online meetings and download infected installation packages. The attack mechanism and the vulnerabilities exploited will be described in more detail on the Kaspersky ICS CERT website. Detection by Kaspersky solutions Kaspersky security solutions successfully detect malicious activity associated with the attacks described above. The malware used in this attack is detected by our solutions with the following detection names: - Backdoor.PHP.WebShell.abi, - Backdoor.Win64.PhantomCore.dt, - Trojan.Win64.Agent.smgvnc, - Trojan.Win64.Agent.smgvnb, - HEUR:Backdoor.Win64.PhantomCore.gen, - HEUR:Backdoor.Linux.Agent.fb, - HEUR:Backdoor.Linux.PhantomHook.a, - HEUR:Backdoor.Linux.PhantomReact.a, - Trojan.Win64.PhantomGraph.gen - UDS:Backdoor.Win64.PhantomCore.a Let’s take a closer look using Kaspersky Endpoint Detection and Response Expert (KEDR Expert) as an example. Specifically, activity involving the replacement of the legitimate file …\public\js\locale.php with a web shell, as well as the deletion of entries from TrueConf event logs, is detected by the rule unusual_php_file_creation_from_trueconf_process. Downloading a file containing the PhantomCore backdoor via the replaced legitimate file …\public\js\locale.php is detected by KEDR Expert with the rule unusual_file_creation_from_trueconf. Activity related to the installation of an infected TrueConf client installer containing the PhantomCore backdoor is detected by KEDR Expert using the unsigned_trueconf_installer rule. The Kaspersky Managed Detection and Response service detects the described attack by monitoring the following actions: - Creation of suspicious files by TrueConf Server processes. - Execution of a TrueConf Client installer file that lacks a software developer’s signature. - Suspicious process chains associated with TrueConf Client executables and TrueConf Client update executables. - Registration of suspicious libraries in the HKEY_CURRENT_USER\Software\Classes\CLSID\ registry key. - Actions related to retrieving information about the lsass.exe process. - Memory dump creation for the lsass.exe process using thecomsvcs.dll library. - Accessing the memory of the lsass.exe process. - Creating tunnels using the ssh process. To protect companies using our Kaspersky SIEM system, a general set of rules is available in the product repository that allows detection of the following techniques: - Creation of suspicious files in the C:\Windows\System32\inetsrv* directory: R405_07_File write to IIS native modules folder or OWA via WriteData. - Creating a memory dump of the lsass.exe process using thecomsvcs.dll library: R233_04_Process memory dump via comsvcs.dll. - Accessing the memory of the lsass.exe process: R262_Suspicious access to the LSASS process. We also recommend paying attention to the following events when developing your own detection rules or conducting threat hunting: - Registration of suspicious libraries in the registry key \Software\Classes\CLSID{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32: 12(DeviceEventClassID = '4657' OR DeviceEventClassID = '13')AND FileName like '%\Software\Classes\CLSID{0340F119-A598-4ed9-B0AC-6F6A12D3E755}%' AND DeviceCustomString6 = 'InprocServer32' - Creating the SysExcSvc andSysReadSvc services to run executables from temporary directories in the background via cmd: 123DeviceEventClassID = '4697'AND (DestinationServiceName = 'SysExcSvc' OR DestinationServiceName = 'SysReadSvc')AND match (FileName, '.cmd\s+/c.temp\cmd_cmd_..bat.') - Creation of suspicious processes originating from the TrueConf update process (trueconf_windows_update.exe) 12(DeviceEventClassID = '4688' OR DeviceEventClassID = '1')AND SourceProcessName LIKE '%\trueconf_windows_update.exe' For the detection rules to work correctly, ensure that events from Windows systems are received in full, including Security events 4688, 4663, 4657, 4697 and Sysmon events 1, 7, 11, 13. Indicators of compromise File hashes (MD5) Web shell 4d27b4eb1c5dbb3d8160f29b8119523e locale.php Infected installer 748c9f8cb1065000616204935f96207f trueconf_windows_update.exe PhantomCore DLL c5a460e4e68a088f6e51b2c6474642ec 129462164a7d52e9ea8560b60f0412c5 doc.txt ec0bf4a2186a88874e9f26f07cfeb532 usocacheddata.txt b348642146ea34771e5785c5857950f5 c915cb6c2aeb863ee8479238e1644217 doc.txt 0e79996d9483d1e44fea32b0a48c2c19 doc.txt 2bb75c20e778eb5c4169