Attackers have been breaking into TrueConf video conferencing servers and quietly swapping the client software those servers hand out, turning a company's own meeting platform into a delivery route for spyware, Kaspersky researchers reported in new research published on August 11.
The team detected the campaign in July 2026 and attributes it to Head Mare, a group it had previously tracked as hacktivists and now classifies as an APT, citing the sophistication of its tradecraft and the absence of any destructive activity such as encryption or wiping in the networks it reaches. Kaspersky says it is watching several active Head Mare campaigns against Russian organizations in instrument manufacturing, electronics, transport, energy, IT and software development. Our Russia country profile tracks the wider picture.
What is affected
The intrusions turned on two previously unknown flaws in TrueConf Server, carrying Kaspersky's internal identifiers KLCERT-26-057 and KLCERT-26-058. The first has been assigned CVE-2026-72529. Kaspersky ICS CERT's advisory for that flaw, credited to principal security researcher Vyacheslav Kopeytsev, records it as remotely exploitable at low attack complexity, with no privileges and no user interaction required, and high impact to confidentiality, integrity and availability. It is a missing authentication issue (CWE-306) reachable over port 4307/TCP, which the product documentation says is open by default.
Vulnerable builds are all versions before 5.3, the 5.3.x line before 5.3.9, the 5.4.x line before 5.4.9, and the 5.5.x line before 5.5.5, on both Windows and Linux. TrueConf shipped the fixes in 5.3.9, 5.4.9 and 5.5.5 on June 18, 2026, so servers that have not been updated since have been exposed for close to two months.
How the attack works
Head Mare connects to the server on 4307/TCP without logging in and calls an undocumented function to push a script onto it. That script normally runs inside an isolated environment with no access to operating system functions, which should limit the damage. The second flaw, KLCERT-26-058, lets the attackers escape that sandbox and run commands against the operating system itself, with the privileges of the NT AUTHORITY\SYSTEM account.
From there they overwrite a legitimate file in the server's web directory, public\js\locale.php, with a web shell. Kaspersky saw that shell used to map the victim's IT estate, reach into the TrueConf database, and, most damagingly, replace the genuine TrueConf Client distribution with a tampered build carrying the PhantomCore backdoor. Anyone pointed at that server for a meeting was offered the poisoned installer.
On compromised hosts the group also deployed a second backdoor Kaspersky has named PhantomGraph, built from two DLLs: SysExcSvc.dll takes commands and returns results, using an attacker-controlled Microsoft OneDrive account as the command channel, while SysReadSvc.dll executes them through a batch file and saves the output. Both are installed as Windows services by a Base64-encoded PowerShell command that the operators deliberately split into two parts, which Kaspersky assesses was done to make the activity harder for endpoint detection tools to spot. Parts of the code overlap with PhantomCore, tying the new tool to the same arsenal. Follow-on commands seen in the intrusions include a memory dump of the lsass.exe process, basic host and user reconnaissance, and an SSH reverse tunnel out of the network.
What you should do
Update TrueConf Server to 5.3.9, 5.4.9 or 5.5.5. Kaspersky also urges organizations to verify that client packages downloaded from their TrueConf server carry a valid TrueConf digital signature: the malicious installers it found are unsigned. The warning extends past your own estate, because employees routinely join meetings hosted by business partners and download the client from those servers, so a partner's unpatched box becomes your problem.
Salient indicators, defanged: the web shell locale.php (MD5 4d27b4eb1c5dbb3d8160f29b8119523e), the trojanized updater trueconf_windows_update.exe (MD5 748c9f8cb1065000616204935f96207f), Windows services named SysExcSvc and SysReadSvc, and infrastructure at 81[.]177[.]32[.]12 and 194[.]87[.]239[.]71. Kaspersky's report carries the full hash, domain and file path list along with YARA rules and SIEM queries.
The case echoes an earlier compromise of a trusted Russian software update channel, when attackers hijacked ViPNet updates to backdoor government networks. Both work the same way: rather than fight the defenses, subvert the distribution point the victim already trusts.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.