TrueConf Becomes Strategic Chokepoint: Compromised Servers…

At least three distinct attack campaigns — attributed to Ukrainian hacktivists and Chinese threat actors — have compromised on-premise TrueConf servers to trojanize client installers. The flaw: clients auto-update without verifying integrity, turning every infected server into a silent malware distribution hub.

The TrueConf videoconferencing software has been turned into a silent malware distribution channel. At least three distinct campaigns — with attributions ranging from Ukrainian hacktivist groups to Chinese threat actors — have compromised on-premise servers to replace client installers with trojanized versions. The technique requires no user action: clients connect to the infected server and automatically download the malicious update.

Key Takeaways

Kaspersky discovered in July 2026 that the Head Mare group compromised TrueConf servers exposing TCP port 4307, replacing client installers with a backdoor dubbed PhantomCore
CVE-2026-3502 (CVSS 7.8, HIGH) documents an architectural flaw in the TrueConf client that applies updates without verifying their integrity, allowing an attacker with server control to distribute arbitrary code
CISA added CVE-2026-3502 to the KEV catalog on April 2, 2026, with a mandatory patch deadline for U.S. federal agencies set for April 16, 2026
The risk extends beyond organizations hosting TrueConf servers: employees joining meetings on compromised counterparty servers can unknowingly install backdoors on their own endpoints

How the Compromise Chain Works: From Server to Client

The attack exploits a fundamental trust relationship: the TrueConf client automatically updates from the on-premise server to which it is connected. According to the Kaspersky report, vulnerable servers exposed TCP port 4307 open by default without authentication. From there, attackers exploited two internal vulnerabilities identified as KLCERT-26-057 and KLCERT-26-058 to achieve remote code execution with maximum privileges and sandbox escape.

With NT AUTHORITY\SYSTEM privileges, the attacker installed a web shell in the local.php file to maintain persistent access. The PhantomCore backdoor is distributed via a digitally unsigned client installer: clients connect to the compromised server and receive the infected update as part of the normal operational flow. The dossier does not specify whether the original TrueConf installers were digitally signed.

In parallel, Kaspersky identified PhantomGraph, a second backdoor that uses Microsoft OneDrive accounts to receive commands, exfiltrate credentials from LSASS, and create reverse SSH tunnels. The distribution mechanism remains identical: the compromised server delivers the payload through the legitimate update channel.

CVE-2026-3502: The Architectural Flaw Enabling the Supply-Chain Attack

The CVE-2026-3502 record, published by CNA Check Point, precisely describes the mechanism that turns server compromise into mass client compromise: "TrueConf Client downloads application update code and applies it without performing verification." The CVSS 3.1 score is 7.8 (HIGH), with vector AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L. Affected client versions range from 8.1.0 to 8.5.2; the fix is available in version 8.5.3.

Check Point reported the TrueChaos campaign, active since March 2026, which exploits this exact flaw to distribute the Havoc C2 framework. Attribution is assessed with moderate confidence to a Chinese threat actor. The Check Point campaign and the Head Mare campaign discovered by Kaspersky share the same technical pattern — server compromise for client trojanization — but the dossier does not confirm they are conducted by the same group.

Converging Campaigns: A Recognized Pattern, a Strategic Target

The temporal overlap of campaigns indicates TrueConf has become a systematic target. Positive Technologies documented activity by the PhantomCore group (also known as Head Mare, Fairy Trickster, Rainbow Hyena, UNG0901) against TrueConf servers in Russia as early as September 2025, using a chain of three vulnerabilities: BDU:2025-10114, BDU:2025-10115, and BDU-2025-10116. These included a command injection flaw with CVSS up to 9.8 (CRITICAL).

Positive Technologies researchers Daniil Grigoryan and Georgy Khandozhko stated: "PhantomCore actively searches for vulnerabilities in domestic software, develops exploits, and thereby gains the ability to infiltrate a large number of Russian companies." This observation is relevant to the broader picture: the group explicitly selects software with presumed "digital sovereignty" precisely because it represents a less-monitored vector compared to Western platforms.

The dossier does not establish whether the KLCERT-26-057/058 vulnerabilities have been assigned official CVEs or are distinct from CVE-2026-3502, nor whether the BDU vulnerabilities correspond to the same ones in the Kaspersky report.

Risk Beyond Your Own Perimeter: When the Counterparty Is the Vector

The distributed nature of TrueConf — often installed on-premise by organizations that join meetings with external partners — creates an attack surface that transcends traditional network perimeters. Kaspersky highlighted this with an operationally critical clarification: even organizations that do not host a TrueConf server are exposed if their employees connect to compromised counterparty servers.

"Even if your organization does not use the TrueConf server, employees of the organization can connect to compromised counterparty TrueConf servers to participate in online meetings and download infected installation packages" — Kaspersky (via BleepingComputer)

Check Point underscored the same dynamic: "The exploitation of CVE-2026-3502 did not require the attacker to compromise each endpoint individually. Instead, the attacker abused the trusted relationship between a central on-premises TrueConf server and its clients." This centralized architecture, lacking cryptographic integrity verification, turns every compromised server into a malware distribution point with unlimited reach.

What to Do Now

Verify server and client versions. TrueConf released server patches in versions 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026. For the client, the fixed version is 8.5.3. Administrators must confirm both components are updated beyond the vulnerable thresholds.

Isolate or monitor TCP port 4307. The port was open by default on vulnerable servers without authentication. If immediate patching is not possible, restrict its exposure to the internal network and monitor inbound traffic.

Check for web shell in local.php. The Kaspersky report identifies this file as the location of the web shell installed by attackers for persistent access. An integrity check on this specific file serves as a compromise indicator.

Verify the counterparty perimeter. Security teams must identify which partners or customers use TrueConf and assess whether employee connections to external servers are justified or can be limited until patching is confirmed.

The TrueConf Lesson: Digital Sovereignty Without Supply-Chain Security Is a Mirage

The geopolitical angle is unequivocal. Multiple campaigns, with different motivations and attributions, selected TrueConf despite — or perhaps because — it represents a national alternative to Western platforms. The presumed sovereignty advantage has translated into a concentration of risk on a less-scrutinized target, with update mechanisms that replicate classic supply-chain security errors already documented in more widely deployed software.

The case raises a structural question for organizations evaluating strategic migrations from global platforms to national solutions: cryptographic verification of update integrity is not an advanced security optional, but a fundamental architectural requirement. Its absence in CVE-2026-3502, combined with the ease of server-side compromise, created a systemic vulnerability that attackers have exploited in a repeated and convergent manner.

The dossier does not specify whether the integrity verification flaw in CVE-2026-3502 was fully resolved in the June 2026 server patches or requires a dedicated client update as well: administrators must treat both components as potentially independent in the remediation cycle.

FAQ

Q: Do the June 2026 server patches also fix CVE-2026-3502?
A: The dossier does not clarify this overlap. The server patches (5.3.9, 5.4.9, 5.5.5) address the KLCERT-26-057/058 vulnerabilities used for initial access, but CVE-2026-3502 concerns the client update mechanism. Updating both components is recommended.

Q: Did the trojanized installers require the user to manually accept the update?
A: No. The TrueConf client applies updates automatically from the server to which it is connected. The process is fully automatic and requires no user interaction, as documented by both Kaspersky and Check Point.

Q: Are Head Mare and the threat actor behind TrueChaos the same entity?
A: The dossier does not confirm this overlap. Attributions differ (Ukrainian hacktivists vs. Chinese threat actor) with varying confidence levels. The campaigns share the technical pattern but may be independent.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references