Head Mare Exploits TrueConf Server Flaws to Deploy PhantomCore Malware
The threat actor Head Mare is exploiting unpatched TrueConf Server vulnerabilities to target Russian companies, replacing legitimate client installers with the PhantomCore malware.
The threat actor known as Head Mare has resurfaced, weaponizing previously disclosed security flaws in unpatched TrueConf servers to target Russian companies across critical sectors including instrumentation, electronics, transport, energy, IT, and software development. Cybersecurity firm Kaspersky detected this ongoing campaign in July 2026, indicating a persistent threat to organizations that have not yet applied necessary security updates.
The attacks leverage a vulnerability chain affecting TrueConf server versions 5.3.x up to 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and earlier. The exploitation process begins by connecting to the TrueConf server on the default TCP port 4307. Attackers then exploit vulnerabilities KLCERT-26-057 and KLCERT-26-058, which allow for arbitrary code execution with elevated privileges. Initially, a malicious script runs within an isolated environment on the server, but the second vulnerability enables an escape from this sandbox to execute arbitrary commands on the underlying host with SYSTEM privileges.
Once elevated access is achieved, attackers replace a legitimate server file, "...\public\js\locale.php," with a web shell. This web shell provides persistent remote access to the compromised server and is used to gather intelligence on the victim's IT infrastructure. It also grants privileged access to the TrueConf database, which is a crucial step in preparing to distribute the malicious payload.
The ultimate goal of this attack chain is to substitute the original TrueConf Client distribution with a poisoned version. This modified installer delivers the PhantomCore backdoor and remote access trojan (RAT) to susceptible systems, effectively compromising end-user machines. The attackers also deploy a secondary backdoor, codenamed PhantomGraph, which shares code similarities with PhantomCore and uses Microsoft OneDrive for command and control (C2) communications via a component named "SysExcSvc.dll."
To ensure persistence and evade detection, the attackers install "SysExcSvc.dll" and "SysReadSvc.dll" as Windows services using a Base64-encoded PowerShell command. Kaspersky notes that splitting the malware into two components likely aims to complicate detection by Endpoint Detection and Response (EDR) tools. The threat actors also engage in further reconnaissance, including taking memory dumps of the "lsass.exe" process and establishing SSH reverse tunnels.
The vendor has since released patches for the exploited vulnerabilities, with updated versions 5.3.9, 5.4.9, and 5.5.5 of TrueConf Server released on June 18, 2026. Organizations are strongly advised to update to the latest versions to mitigate these risks.
This is not the first time Head Mare has targeted TrueConf; earlier in April, the group was linked to exploiting other vulnerabilities in the software to deliver web shells and malicious payloads. Furthermore, the TrueConf client itself was targeted by a separate campaign using a zero-day flaw (CVE-2026-3502) to deploy the Havoc C2 framework against government entities in Southeast Asia.
The continued exploitation of TrueConf vulnerabilities by Head Mare highlights the persistent threat posed by unpatched software and the sophisticated tactics employed by threat actors to target specific regions and industries. The group's ability to chain vulnerabilities and deploy multi-stage malware like PhantomCore underscores the need for continuous security vigilance and prompt patching.