Head Mare Group Breaches TrueConf to Deploy Backdoors

Executive Summary

The pro-Ukrainian hacktivist group Head Mare is conducting a sophisticated supply-chain attack by exploiting vulnerabilities in TrueConf video conferencing servers. According to research from Kaspersky, the group is compromising unpatched servers to replace legitimate TrueConf client installers with trojanized versions. These malicious installers, when downloaded and run by users, deploy backdoors including PhantomCore RAT and PhantomGraph. The campaign, observed in July 2026, has targeted Russian organizations across multiple sectors, demonstrating the group's growing technical capabilities and its focus on disruptive attacks.

Threat Overview

The attack targets organizations in Russia using on-premise TrueConf Server instances. Head Mare's operation leverages a chain of two vulnerabilities (KLCERT-26-057 and KLCERT-26-058) in older versions of the software to achieve full system control and then poison the software distribution mechanism.

Attack Chain:

1. Initial Access: The attackers connect to a vulnerable TrueConf server on the default TCP port 4307. (T1190 - Exploit Public-Facing Application)
2. Privilege Escalation: They exploit a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) to escape a sandbox environment and execute commands with NT AUTHORITY\SYSTEM privileges. (T1068 - Exploitation for Privilege Escalation)
3. Persistence: A web shell is installed by replacing the legitimate locale.php file, giving the attackers persistent remote access to the server. (T1505.003 - Web Shell)
4. Supply Chain Compromise: Using the web shell, the attackers substitute the legitimate, digitally signed TrueConf client installer with a trojanized, unsigned version.
5. Impact: When users download the client from the compromised server, they receive the malicious version, which installs the PhantomCore RAT. This provides the attackers with remote control over the victim's workstation. (T1195.002 - Compromise Software Supply Chain)

Technical Analysis

• Threat Actor: Head Mare, a hacktivist group with increasing sophistication, known for targeting Russian entities.
• Vulnerabilities: KLCERT-26-057 and KLCERT-26-058 (No CVEs assigned). These allow for sandbox escape and arbitrary code execution.
• Affected Software: TrueConf Server versions 5.3.x (before 5.3.9), 5.4.x (before 5.4.9), and 5.5.x (before 5.5.5).
• Malware:
  • PhantomCore: A remote access trojan (RAT) that gives attackers control over the infected machine.
  • PhantomGraph: A secondary backdoor also deployed in the campaign.

A key indicator of this attack is that the malicious installer is not digitally signed, whereas the legitimate TrueConf installer is. This provides a crucial verification point for security-conscious users.

Impact Assessment

This campaign has a significant impact on the targeted Russian organizations.

• Espionage and Data Theft: The deployment of a RAT allows Head Mare to exfiltrate sensitive data, monitor communications, and gain a deep understanding of the victim's internal network and operations.
• Supply Chain Risk: By compromising a central server, the attackers can infect any employee or external partner who downloads the client software, amplifying the breach's scale.
• Reputational Damage: For the affected organizations, a breach of their communications platform can damage trust with partners and clients.
• Targeted Sectors: The attack has been observed against a wide array of industries, including instrumentation, electronics, transport, energy, and IT, indicating a broad targeting strategy.

IOCs — Directly from Articles

Cyber Observables — Hunting Hints

Security teams can hunt for signs of this activity:

Detection & Response

1. File Integrity Monitoring: Implement FIM on TrueConf web server directories to detect unauthorized changes to files like locale.php. Use System File Analysis (D3-SFA).
2. Signature Verification: Before deploying or allowing users to download software, verify its digital signature. Create policies to block or alert on the execution of unsigned executables. This aligns with Executable Allowlisting (D3-EAL).
3. Network Monitoring: Monitor for and alert on suspicious outbound connections from TrueConf servers, which could indicate web shell or RAT activity.

Mitigation

1. Patch Immediately (M1051): Update all TrueConf Server instances to the latest patched versions (5.3.9, 5.4.9, 5.5.5 or newer). TrueConf released patches on June 18, 2026.
2. Code Signing Verification (M1045): Educate users and administrators to always verify the digital signature of software before installation. This is a critical step in preventing this type of supply-chain attack.
3. Restrict Access: Limit network access to the TrueConf server management ports from untrusted networks. Apply firewall rules to allow connections only from known, safe locations.
4. Web Application Firewall (WAF): Deploy a WAF in front of the TrueConf server to inspect and filter traffic, which may help block the initial exploitation attempts.