Supply Chain Intrusion: Hackers Trojanize TrueConf Server Installers with PhantomCore Backdoors
Executive Summary
Cybersecurity researchers disclosed a major supply chain intrusion on August 8, 2026, confirming that hacktivist group Head Mare compromised unpatched TrueConf video conferencing servers to deliver malicious client installers. Widely deployed across enterprise and government sectors as an on-premises alternative to Zoom and Microsoft Teams, TrueConf servers were breached via unauthenticated TCP port 4307 vulnerabilities (KLCERT-26-057 and KLCERT-26-058). Threat actors achieved NT AUTHORITY\SYSTEM privileges, planted persistent web shells, and trojanized client installation binaries to deliver the PhantomCore and PhantomGraph remote access trojans (RATs) to downstream corporate endpoints.
Technical Breakdown of the TrueConf Exploitation Chain
Forensic analysis by Kaspersky details a multi-stage server compromise and supply chain poisoning attack:
1. Unauthenticated TCP Port 4307 RCE & Sandbox Escape
The initial intrusion vector abused default network daemon configurations:
* Unauthenticated Command Execution (KLCERT-26-057): Attackers connected to TCP port 4307 (open by default) to execute arbitrary commands within TrueConf's isolated server process without presenting credentials.
* Kernel Sandbox Escape (KLCERT-26-058): Attackers chained a second zero-day vulnerability to break out of the TrueConf sandbox, escalating privileges to NT AUTHORITY\SYSTEM on the host OS.
2. Web Shell Persistence & Client Installer Poisoning
Equipped with administrative system control, attackers executed supply chain poisoning:
* Web Shell Planting: Attackers modified \public\js\locale.php, embedding a PHP web shell to maintain persistent remote backdoor access.
* Installer Replacement: Attackers replaced legitimate TrueConf client installer executables hosted on the server with trojanized binaries containing PhantomCore and PhantomGraph RAT payloads, infecting any user downloading desktop client software.
Category
Details
Target Application
TrueConf Server (On-Premises Video Conferencing)
Threat Group
Head Mare
Disclosed Date
August 8, 2026
Vulnerability Identifiers
KLCERT-26-057 (Port 4307 RCE), KLCERT-26-058 (Sandbox Escape)
Payloads Deployed
PhantomCore RAT, PhantomGraph RAT, PHP Web Shell
Impacted Sectors
Enterprise, Government, Telecommunications
Enterprise Video Infrastructure & Supply Chain Risks
The trojanization of TrueConf video conferencing servers highlights the severe risks associated with self-hosted collaboration software. When core communication infrastructure is compromised, attackers can pivot seamlessly from server-level remote code execution to client-side supply chain infections, compromising end-user workstations across the enterprise.
Rigorous perimeter port filtering and cryptographic software integrity verification are vital to securing internal communications platforms.
Recommendations and Mitigations
IT security teams operating on-premises TrueConf servers must execute immediate containment and remediation:
1. Restrict External Access to TCP Port 4307: Block internet exposure on TCP port 4307, restricting daemon connections strictly to trusted internal management subnets.
2. Apply TrueConf Emergency Security Updates: Upgrade TrueConf Server builds to the latest patched release to remediate KLCERT-26-057 and KLCERT-26-058 vulnerabilities.
3. Audit Web Files for Web Shell Implants: Inspect web server directories (specifically \public\js\locale.php) for unauthorized PHP code or unexpected modification timestamps.
4. Re-Verify Client Binary Hash Integrity: Compute cryptographic hashes (SHA-256) of client installer binaries against official vendor release signatures prior to distributing software packages to end users.