Head Mare turned a TrueConf server into a signed-looking software update channel

Kaspersky reported that in July 2026 it detected a Head Mare campaign that chained two TrueConf video conferencing server vulnerabilities to execute code as NT AUTHORITY\SYSTEM and replace the server's original TrueConf Client installers with versions that install the PhantomCore backdoor ^[1][2][7][8]. The consequence is worse than a single compromised server: according to Kaspersky, the malware was delivered to video conference participants, which means the trusted internal download point became the delivery mechanism ^[15][16].

The entry is unauthenticated. Kaspersky says the attackers connected to the TrueConf server over port 4307/TCP, which the product documentation lists as open by default, without prior authorization ^[3]. From there they called a server function to transmit and run a script, the step tracked under Kaspersky's internal identifier KLCERT-26-057 ^[4]. That script runs in an isolated environment where operating system functions are not available by default, so the group used a second flaw, KLCERT-26-058, to break out and execute commands in the operating system context ^[5][6], reaching SYSTEM privileges ^[7]. Neither issue is given a CVE in the report, only the vendor-independent KLCERT references ^[4][6].

Persistence on the server side was mundane and effective: the file ...\public\js\locale.php was replaced with a web shell ^[9]. Kaspersky says that shell was used to collect IT infrastructure data, obtain privileged access to the TrueConf database, and replace the client distribution ^[10]. On infected endpoints, PhantomCore auto-starts via a registry key under HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 pointing at the malicious file ^[11].

The same web shell also loaded a second backdoor Kaspersky named PhantomGraph, built from two DLLs: SysExcSvc.dll handles command receipt and result transmission, using an attacker-controlled Microsoft OneDrive account as command and control, while SysReadSvc.dll reads, executes, and stores the result ^[12][13]. Both are installed as Windows services by a Base64-encoded PowerShell command, and Kaspersky's assessment is that the split into two components was deliberate, to complicate EDR detection ^[14]. Code overlap with PhantomCore is the basis for attributing PhantomGraph to Head Mare's toolkit ^[17].

The hands-on activity was standard credential theft and tunnelling: an lsass.exe memory dump, user and system name reconnaissance, and an SSH reverse tunnel, executed through a BATCH file ^[18]. Some commands failed outright because of the operators' typos and encoding errors ^[19]. Kaspersky has reclassified Head Mare from hacktivists to an APT group, citing TTP sophistication and the absence of encryption or wiping in the targeted infrastructures, and says several Head Mare campaigns against Russian organizations across industries remain active ^[20][21].

The timing is the part defenders should sit with. TrueConf patched the flaws in Server 5.3.9, 5.4.9 and 5.5.5, released June 18, 2026 ^[22], at least 13 days before the earliest possible date of Kaspersky's July detection ^[23]. There is also an ambiguity in the report worth resolving with the vendor: the affected ranges are given as 5.3.X through 5.3.9, 5.4.X through 5.4.9 and 5.5.X through 5.5.5, which are the same build numbers named as the fixes ^[24][22].

Watch for CVE assignment and a public vendor advisory against those KLCERT identifiers, for exposure counts on 4307/TCP once scanning data catches up, and for whether other conferencing and internal distribution servers get the same treatment. Any organisation that ran an affected TrueConf build should treat every client installer pulled from it since June as suspect, not just the server itself ^[10][15].