The Head Mare APT group compromised TrueConf servers by exploiting a chain of two zero-day vulnerabilities, turning video-conferencing infrastructure into a malware distributor for meeting participants. The attack, detected in July 2026, followed the release of patches on June 18, 2026, but exposes a threat model that has gone largely unnoticed: the security of the participant depends on the compromise of the remote server.
- Head Mare has been reclassified from hacktivist to APT due to the sophistication of its tactics and the absence of destructive activity in targeted infrastructures
- Two internal zero-day vulnerabilities, KLCERT-26-057 and KLCERT-26-058, enable pre-auth RCE via port 4307/TCP and sandbox escape with SYSTEM privileges
- Attackers replace legitimate client installers with infected versions that deliver the PhantomCore and PhantomGraph backdoors
- The risk extends to organizations that do not use TrueConf Server directly but connect to compromised partner servers
From Hacktivism to APT: Head Mare Reclassified
Kaspersky's Global Research and Analysis Team has redefined Head Mare as an APT group, dropping its previous hacktivist classification. The source cites the sophistication of the tactics, techniques, and procedures employed, combined with the absence of destructive activity such as encryption or wiping in compromised infrastructures. This lack of destructive payloads operationally distinguishes Head Mare from many actors operating in the same geopolitical theater.
Documented active campaigns have targeted Russian organizations across six industrial sectors: instrumentation, electronics, transportation, energy, IT, and software development. The shift from public defacement to silent infiltration marks an evolution that demands a reassessment of the threat model associated with this actor.
"we define them as an APT group due to the sophistication of their TTPs and the absence of destructive activity (encryption, wiping) in the targeted infrastructures" — Kaspersky Securelist
The Six-Stage Kill Chain: How the Sandbox Breaks
The attack begins with a connection to the TrueConf server without prior authentication, exploiting the default-open port 4307/TCP. The first vulnerability, KLCERT-26-057, allows remote script execution. From this access, attackers trigger the second vulnerability, KLCERT-26-058, which bypasses isolated-environment restrictions to execute commands in the operating-system context with NT AUTHORITY\SYSTEM privileges.
The sandboxing architecture, designed to contain the damage of a potential compromise, is thus converted into an attack strength: the security separation becomes the mechanism that, once breached, guarantees the highest level of access. This pattern of "security feature abuse" is particularly insidious because it challenges the assumptions on which defense teams build their architectures.
After escalation, attackers replace the file …\public\js\locale.php with a web shell for persistent remote control. Through this, they gather data on the IT infrastructure, access the TrueConf database with elevated privileges, and proceed to replace the client installer with a version containing the PhantomCore backdoor.
PhantomCore and PhantomGraph: Two Backdoors, Two Functions
PhantomCore achieves persistence via a specific registry key: HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32. This user-level persistence mechanism, rather than system-wide, indicates a design intended to avoid detections that monitor modifications to privileged registry areas.
PhantomCore operates in tandem with PhantomGraph, which consists of two dedicated modules. SysExcSvc.dll handles communications with the command-and-control server, which the source explicitly identifies as a Microsoft OneDrive cloud storage account. SysReadSvc.dll executes received remote commands. Both modules are installed as Windows services via Base64-encoded PowerShell commands. The source documents that the attackers deliberately split the malicious command into two components to make detection by EDR tools more difficult.
The operators themselves committed typos and encoding issues in some commands, a detail the source reports without interpretation: these errors could indicate operational pressure, testing in production, or simply the frequency of attacks that makes perfect preparation unlikely for every single compromise.
Affected Versions and Malware Distribution
Vulnerable TrueConf Server versions are those in the 5.3.X family up to 5.3.9, 5.4.X up to 5.4.9, and 5.5.X up to 5.5.5. Patches released on June 18, 2026, fix the vulnerabilities in versions 5.3.9, 5.4.9, and 5.5.5. The attack was detected in July 2026, configuring a scenario in which patches were available but not yet applied on compromised servers.
The malicious installers distributed to users lack a valid TrueConf digital signature. This element, reported by the source, represents a verifiable checkpoint for end users, although the practice of signature verification is not standardized in many organizations. The compromise of the software distribution channel turns a video-conferencing server into a supply-chain attack vehicle: the risk is not limited to server owners but extends to every participant who downloads the client from a compromised instance.
"Even if your organization does not use a TrueConf server, your employees may connect to compromised TrueConf servers belonging to business partners to participate in online meetings and download infected installation packages" — Kaspersky Securelist
What to Do Now
TrueConf Server administrators must verify the installation of patched versions 5.3.9, 5.4.9, or 5.5.5 released on June 18, 2026. The three previous version families — 5.3.X-5.3.8, 5.4.X-5.4.8, 5.5.X-5.5.4 — remain vulnerable to the documented exploit chain.
For participants in video conferences on third-party servers, the source highlights a practical check: verify the presence of the TrueConf digital signature on every downloaded installer. The malicious installers distributed in the campaign do not possess this signature. This verification, while not standardized in many organizational procedures, constitutes the only documented filter available to the end user.
Security teams must monitor the registry key HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 to detect PhantomCore persistence, and the filenames SysExcSvc.dll and SysReadSvc.dll to identify PhantomGraph modules. The source does not assess the coverage of commercial EDR signatures on these indicators.
Organizations that participate in video conferences on partner servers must recognize that internal perimeter controls — firewalls, network segmentation, EDR on endpoints — do not intercept this vector: the malware arrives via an apparently legitimate distribution channel, from a trusted external infrastructure.
Limits and Context
The dossier does not document specific remedial measures for end users beyond applying patches on their own servers. The source does not specify the nature of data exfiltrated in the detected campaigns, nor does it provide a count of compromised organizations. It does not emerge from the available documentation whether vulnerabilities KLCERT-26-057 and KLCERT-26-058 will receive public CVE identifiers, nor whether other security vendors have independently detected the same campaign.
The Kaspersky article appears truncated in the provided source, with possible impact on the completeness of indicators of compromise and detection rules. The precise geographic attribution of Head Mare is not stated: the source does not report infrastructure overlaps linking the group to a specific state actor at this time. The original report's publication date (2022) is inconsistent with the temporal content of the analysis (2026), an element the source does not clarify and which constitutes a limit on external verifiability.
Analysis: When the Partner Server Is the Enemy
This attack highlights a structural asymmetry in enterprise communications security. Organizations invest resources in protecting their own endpoints but depend, by definition, on someone else's infrastructure when participating in external video conferences. Compromise of the remote server nullifies this separation: the legitimate participant becomes an unwitting vector. The choice of OneDrive as C2 infrastructure, instead of dedicated domains, adds another layer of mimicry: traffic to legitimate Microsoft services is among the least suspicious in enterprise environments.
Frequently Asked Questions
- Do the patches released on June 18, 2026, also protect earlier vulnerable versions?
- According to the source, versions 5.3.9, 5.4.9, and 5.5.5 contain the fixes. Previous version families prior to the patch (5.3.X-5.3.8, 5.4.X-5.4.8, 5.5.X-5.5.4) remain vulnerable if not updated to these releases.
- How can a compromised TrueConf installer be recognized?
- The source reports that malicious installers lack a valid TrueConf digital signature. The dossier does not document further specific visible or behavioral indicators.
- Can end users detect PhantomCore or PhantomGraph on their own?
- The source provides specific indicators of compromise, including the PhantomCore registry key and PhantomGraph module filenames, but does not assess detectability via consumer tools or the coverage of commercial EDR signatures.
Information is based on the cited source and current as of publication.