The Head Mare hacktivist group breached TrueConf video conferencing servers and replaced legitimate client installers with malicious versions carrying backdoors, according to Kaspersky researchers who discovered the campaign. Because TrueConf serves as an on-premise alternative to Zoom and Microsoft Teams for Russian enterprise and government users, any employee connecting to a compromised server, including one operated by a counterparty, could receive the infected installer as an update.
Unauthenticated Access Over Port 4307 and the Escape From the Sandbox
Kaspersky, which detected the activity in July, said the attackers connected to TrueConf servers over TCP port 4307, which is open by default, without any authentication. Two vulnerabilities enabled the breach, tracked internally as KLCERT-26-057 and KLCERT-26-058. The first executes a malicious script within TrueConf’s isolated environment, and the second escapes that sandbox to run commands on the underlying operating system.
Escalation to SYSTEM and the locale.php Web Shell
Once inside, the attackers escalated privileges to NT AUTHORITYSYSTEM and replaced the publicjslocale.php file with a web shell, establishing persistent remote access. Kaspersky said the web shell was then used to collect sensitive information, access the TrueConf database, and swap the legitimate TrueConf Client installer for a trojanized, non-digitally-signed copy carrying the PhantomCore backdoor.
The PhantomGraph Backdoor and OneDrive-Based Command Channel
A separate implant, PhantomGraph, consists of two DLLs, SysExcSvc.dll and SysReadSvc.dll, that accept commands through a Microsoft OneDrive account. Observed activity includes dumping LSASS memory to exfiltrate credentials, reconnaissance such as hostname and whoami queries, and starting a reverse SSH tunnel, according to the researchers.
The Scope of Head Mare Operations Against Russian Organizations
Kaspersky documented multiple active Head Mare campaigns targeting Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development. The group’s initial access routes include phishing, exploitation of public-facing web servers, and compromise through contractors, the researchers said.
Fixed Versions 5.3.9, 5.4.9, and 5.5.5 and Affected Branches
TrueConf addressed the flaws in versions 5.3.9, 5.4.9, and 5.5.5, released in June. The affected lines are TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, and 5.5.x before 5.5.5, along with older versions. Any organization still running unpatched versions remains exposed to the same unauthenticated access path.
Distinguishing This Campaign From the Earlier True Chaos Disclosures
The Head Mare supply-chain breach is separate from an April operation reported by Check Point in which a different TrueConf zero-day, CVE-2026-3502, was used in “Operation True Chaos” through trojanized client updates, tentatively attributed to Chinese actors behind the Havoc implant. The two episodes underline that TrueConf’s update mechanism has become a target for distinct adversaries in successive quarters.
Patching, Audit Guidance, and the Trust Problem for Supply-Chain Users
Organizations should apply TrueConf Server 5.3.9, 5.4.9, or 5.5.5 depending on their branch and treat any client installer downloaded since before patching as potentially trojanized, Kaspersky’s guidance indicates. Auditors should look for the KLCERT-26-057 and KLCERT-26-058 indicators, the locale.php web shell, the PhantomCore and PhantomGraph DLLs, and reverse SSH tunnels.
Treating TrueConf Client Installers as Potentially Trojanized
The practical difficulty for TrueConf customers is that a clean vendor relationship no longer implies a safe update path. Once a server is compromised, the client software it distributes can be replaced without any signature change that would raise an immediate alarm, because the trojanized installer is distributed from the trusted endpoint itself.
Why the TrueConf Update Channel Invites Supply-Chain Breaches
Video conferencing platforms are attractive because they sit at the boundary between organizations and their external partners, which means a single compromised server reaches every caller who joins through it. The Head Mare campaign, combined with the earlier trojanized-update operation, shows the pattern repeating: an unpatched conferencing appliance, SYSTEM-level access, and a poisoned update channel that turns routine maintenance into the primary delivery mechanism for backdoors.
