TrueConf: Head Mare Supply-Chain Compromise via Trojanized Client Installers

The Head Mare hacktivist group compromised unpatched TrueConf video conferencing servers and replaced the client installers those servers hand out to their own users with trojanized, unsigned builds carrying the PhantomCore and PhantomGraph backdoors. Kaspersky researchers discovered the activity in July 2026 and disclosed it in early August, per BleepingComputer and corroborating write-ups from Suriq and Igor's Lab. The intrusion path required no credentials: TrueConf servers listen on TCP port 4307, which ships open and accepts unauthenticated connections. No victim count, record count, or named affected organization has been published by any of the available sources. TrueConf itself serves roughly 100,000 organizations globally, according to Check Point figures cited by The Record, which frames the potential blast radius rather than the confirmed one.

What Happened

Kaspersky attributes the campaign to Head Mare, a group tracked as hacktivist in orientation and previously active against Russian targets. BleepingComputer notes TrueConf is widely deployed in Russia across enterprise and government as an on-premise alternative to Zoom and Microsoft Teams; The Record, citing Check Point, describes a broader install base across Asia, Europe and the Americas concentrated in government, military and critical infrastructure.

The operators reached exposed servers over TCP 4307 without authenticating, chained two flaws Kaspersky tracks internally as KLCERT-26-057 and KLCERT-26-058, escalated to NT AUTHORITY\SYSTEM, and established persistence by overwriting the legitimate server file \public\js\locale.php with a web shell. From there they swapped the TrueConf Client installer hosted on the server for a backdoored build. Members of the organization who connected to the server received that build as a routine update, unsigned.

Suriq reports the affected server branches as builds older than 5.3.9, 5.4.9 and 5.5.5, plus 5.2 and earlier. That version breakdown appears in only one OTHER-tier source and should be validated against the vendor's own advisory before it drives remediation scoping.

Accounts Differ on the Vulnerability Picture

Two distinct threads run through these sources, and they should not be collapsed into one.

The Kaspersky thread covers server-side flaws identified by internal KLCERT identifiers with no public CVE assigned in any source here. The second thread is CVE-2026-3502, a client-side flaw in the TrueConf Windows Client update mechanism: per Tenable, the updater performs no cryptographic verification of update packages, so an attacker controlling a TrueConf server can distribute and execute arbitrary code on connected endpoints. Tenable rates it CVSS v3 7.8 (High) with a VPR of 9 (Critical, 99.75th percentile), fixed in client 8.5.3.884, patch published 25 March 2026, with a CISA Known Exploited Vulnerability remediation deadline of 16 April 2026.

Attribution on CVE-2026-3502 points somewhere else entirely. The Record reports that Check Point disclosed the bug to TrueConf and tied its exploitation to a suspected Chinese espionage campaign dubbed TrueChaos, targeting government entities in Southeast Asia since early 2026 and leaning on the Havoc post-exploitation framework. That is a different actor, region and motive from Head Mare.

None of the available sources explicitly states whether Head Mare's installer swap abused CVE-2026-3502 as the delivery leg. The mechanism is identical in shape, and it is a reasonable inference, but it is an inference. Treat the two as separate confirmed campaigns exploiting the same architectural weakness until a primary source links them.

What Was Taken

No source publishes a stolen-record figure, and no data-volume range exists to report. What is documented is capability rather than quantified loss.

Kaspersky, as reported by BleepingComputer, states the web shell was used to collect sensitive information from the victim environment and to access the TrueConf database. A conferencing server database is a high-value target on its own: user directories, account credentials or hashes, meeting metadata, and the internal organizational graph of who meets with whom.

The larger exposure is the downstream endpoints. PhantomCore ships inside the trojanized installer. PhantomGraph, per Suriq, arrives as two DLLs and takes commands through attacker-controlled Microsoft OneDrive accounts, letting its C2 traffic blend into ordinary sanctioned cloud usage. Any endpoint that installed a tampered package should be treated as fully compromised with unknown collection scope, not as a malware cleanup.

Why It Matters

A self-hosted conferencing product that also distributes its own client software is two products sharing one hostname, as Suriq puts it. One answers meeting requests; the other hands executables to every endpoint in the building. Compromise the box once and the second function becomes a malware dispenser operating over a trust channel defenders explicitly whitelisted.

The exposure crosses organizational boundaries. Kaspersky's warning, quoted by BleepingComputer, is the part worth pinning to the wall: even organizations that run no TrueConf server of their own are exposed, because employees join meetings on counterparty servers and download installation packages from them. Your patch posture does not protect you from your supplier's.

Two independent actor sets, one hacktivist and one suspected state-aligned, converged on the same class of weakness in the same product within months. That is a signal about update-channel integrity as a category, not about one vendor. Any on-premise product that self-distributes signed or unsigned client binaries deserves the same scrutiny.

The Attack Technique

The full chain as documented by Kaspersky and reproduced across BleepingComputer, Suriq and Igor's Lab:

1. Initial access: unauthenticated connection to TCP 4307, open by default on TrueConf servers. No credentials required, no phishing, no user interaction.
2. Code execution: KLCERT-26-057 executes a malicious script inside TrueConf's isolated environment.
3. Sandbox escape: KLCERT-26-058 breaks out of that isolation to run commands on the underlying Windows host.
4. Privilege escalation: elevation to NT AUTHORITY\SYSTEM.
5. Persistence: the legitimate \public\js\locale.php is replaced with a web shell providing durable remote access.
6. Collection: the web shell harvests environment data and the TrueConf database.
7. Supply-chain delivery: the hosted client installer is replaced with a trojanized, non-digitally-signed build carrying PhantomCore, with PhantomGraph deployed as a paired DLL implant using OneDrive for command and control.

The absence of a valid digital signature on the delivered installer is the single most useful detection artifact in this chain, and the one most likely to be ignored by an update flow that never checked in the first place.

What Organizations Should Do

1. Patch the server first, then the client. Update TrueConf Server past the fixed builds and bring every Windows TrueConf Client to 8.5.3.884 or later for CVE-2026-3502. Fixnx additionally flags client versions 8.1.0 through 8.5.2 for priority remediation and points to the 8.5.4.x line as current; that version guidance is single-source and should be checked against the vendor's own download page.
2. Close or restrict TCP 4307. The default-open, unauthenticated listener is the entire front door here. It has no business being reachable from untrusted networks. Firewall it to known conferencing peers.
3. Hunt for the known artifacts. Check \public\js\locale.php against a known-good copy on every TrueConf server. Look for processes spawned by the TrueConf service running as SYSTEM, and for OneDrive API traffic from hosts with no business reason to generate it, which is PhantomGraph's C2 pattern per Suriq.
4. Audit every installer delivered since spring 2026. Any TrueConf client package installed without a valid digital signature should be treated as a confirmed compromise indicator. Verify vendor checksums before deploying anything going forward, and rebuild rather than clean any host where a tampered package ran.
5. Extend the scope to counterparties. Inventory which external TrueConf servers your staff have joined meetings on and whether any client packages were pulled from them. Kaspersky's cross-organizational warning makes this the step most defenders will skip and most need.
6. Treat CISA KEV deadlines as already blown. CVE-2026-3502 carried a 16 April 2026 federal remediation deadline. If unpatched TrueConf clients are still in your estate in August, assume the update channel has had four months of exposure and investigate accordingly rather than simply patching forward.

Sources: Hackers breach TrueConf to trojanize client installers with backdoors | TrueConf Windows Client < 8.5.3.884 Download of Code Without I...<!... | CISA gives agencies two weeks to patch video conferencing bug explo... | Active Exploitation Alert: Head Mare Hacktivists Exploit TrueConf V... | Head Mare Breaches TrueConf: From SYSTEM Privileges to Trojanized L... | LeakWatch CW 32/2026: Metabase Zero-Day and Xbox Leak | TrueConf servers hijacked to push backdoored installers | CVE-2026-3502 TrueConf Client Vulnerability Fix Fixnx