TrueConf's update directory is the delivery route: two KEV bugs, one swapped installer

The chain is a sandboxed script execution bug bolted to a sandbox escape, and the second half is what makes the first half worth anything. According to Kaspersky ICS CERT, an attacker who can reach port 4307/TCP uses CVE-2026-72529 to execute scripts inside an isolated environment ^[3], then CVE-2026-72530 to leave that environment and run code on the host ^[4]. What the host holds is the point. One part of it is the web root, where `locale.php` is replaced with a web shell used to survey the infrastructure and reach the TrueConf database with privileged access ^[5]. The other is the client distribution directory, where the official Windows x64 installer is replaced with a build carrying PhantomCore ^[6].

The fix is published across three maintained release branches, 5.3.9, 5.4.9 and 5.5.5 ^[13][16]. That spread says the exposure is not limited to whatever version shipped most recently, so an operator sitting on an older supported line does not get to treat this as someone else's upgrade problem.

Detection is where the design gets awkward. The tampered update installs the official client alongside the PhantomCore DLL, and it presents as a normal TrueConf client update ^[7], so an endpoint team looking for an unfamiliar process finds a legitimate one running exactly as expected. The malware hooks TrueConf network functions to hide files and takes commands over the TrueConf protocol itself, while a second backdoor uses GitHub as its C2 ^[9][10]. Egress rules keyed on unusual destinations will not fire on either. What is left is file-level: modifications to `locale.php`, deleted event logs and a hash change on `ClientInstFiles/trueconf_windows_client_x64.exe` on the server ^[5][11][6], plus `api-ms-win-crt-time-l1-1-0-2.dll` under `%LOCALAPPDATA%\TrueConf\Client` and the services `SysExcSvc` or `SysReadSvc` on participant machines ^[8][11].

Kaspersky publishes a four-rung confirmation ladder for this intrusion, from crafted requests to 4307/TCP with no tampering, through script execution via the first CVE, through host code execution and web shell after the second, to tampered installers running on participant devices ^[14]. Three of those four rungs are visible on hardware the server owner controls. The fourth is only visible on endpoints owned by everyone who joined a call ^[15]. That asymmetry is the whole story: patching to a fixed build closes the server, and closes nothing on the machines that already pulled the update.

Kaspersky also notes that no email vector is required ^[12]. The delivery mechanism is the vendor's own update path, so gateway filtering, attachment policy and user training sit outside the blast radius entirely. The mitigations on offer are the unglamorous ones: patch, restrict 4307/TCP to trusted networks, and watch the integrity of the web root and the distribution files ^[13].