Head Mare Hacktivists Exploit TrueConf Server Flaws to Poison Installers with PhantomCore Backdoor
By DigitalSpying Threat Intelligence Team | August 10, 2026
Executive Summary
A sophisticated cyber espionage campaign conducted by the pro-Ukrainian hacktivist collective Head Mare has been uncovered targeting critical infrastructure organizations across Eastern Europe and Eurasia. As reported by The Hacker News, the threat group is exploiting two zero-day vulnerabilities in the widely deployed TrueConf Server enterprise videoconferencing platform: KLCERT-26-057 and KLCERT-26-058.
By chaining an unauthenticated remote code execution (RCE) flaw with an installer poisoning vulnerability, Head Mare replaces official client installation packages hosted on local TrueConf servers with trojanized binaries. When internal users download or update their videoconferencing software, they unknowingly deploy PhantomCore—a modular Remote Access Trojan (RAT) that grants attackers persistent remote control, credential harvesting capabilities, and lateral movement paths across high-value enterprise networks.
Targeted sectors include electronics manufacturing, transportation, energy grid operations, and defense technology. Organizations relying on TrueConf Server must immediately inspect their infrastructure, deploy vendor security patches, and enforce code-signing verification controls.
Technical Deep-Dive: The Attack Chain
Vulnerability Breakdown
The attack campaign exploits unpatched instances of TrueConf Server spanning several major release branches:
* TrueConf Server 5.3.x (versions prior to 5.3.9)
* TrueConf Server 5.4.x (versions prior to 5.4.9)
* TrueConf Server 5.5.x (versions prior to 5.5.5)
The attack chain leverages two specific security defects tracked by Kaspersky's ICS CERT:
1. KLCERT-26-057 (Unauthenticated Remote Code Execution): A critical input validation defect residing in the processing daemon bound to TrueConf's default client-server communication port (TCP Port 4307). Unauthenticated remote attackers send crafted network packets to TCP 4307, exploiting memory parsing logic to execute arbitrary OS commands under the privilege context of the TrueConf system service (SYSTEM on Windows or root on Linux).
2. KLCERT-26-058 (Arbitrary File Replacement / Installer Poisoning): An authorization and path sanitization flaw in the file management subsystem responsible for serving client installation binaries to enterprise users. Coupled with the access gained via KLCERT-26-057, attackers overwrite the legitimate TrueConf_Client.exe / client setup files stored on the server's public distribution directory with trojanized payloads.
Chained Exploitation Lifecycle
[Attacker / Head Mare]
│
│ 1. Malformed Packets to TCP Port 4307 (KLCERT-26-057)
▼
[Unpatched TrueConf Server] ──► 2. Initial RCE (System Privileges)
│
│ 3. Overwrite TrueConf_Client.exe (KLCERT-26-058)
▼
[Poisoned Server Storage]
│
│ 4. Employee Downloads Client Setup / Update
▼
[Victim Enterprise Workstation] ──► 5. Executes PhantomCore RAT
1. Reconnaissance & Initial Access: Head Mare conducts internet-wide scanning for exposed TCP port 4307 bindings. Upon locating an unpatched TrueConf Server, the attackers transmit malformed binary requests to trigger KLCERT-26-057, gaining immediate command execution.
2. Server-Side Installer Poisoning: Utilizing KLCERT-26-058, the threat actors replace the legitimate client installation executable hosted at the server's web download endpoint with a malicious wrapper binary.
3. Internal Distribution: When employees visit their organization's internal TrueConf portal to join a meeting or install the desktop client, they download the poisoned setup file. Because the download originates from an internal, trusted corporate server domain, endpoint security warnings are frequently overlooked by users.
4. PhantomCore RAT Execution: The trojanized installer executes the legitimate TrueConf installation in the foreground to avoid user suspicion while silently dropping and registering the PhantomCore RAT in the background.
Post-Exploitation Tradecraft & PhantomCore RAT Capabilities
PhantomCore Architecture
PhantomCore is a custom, multi-stage Remote Access Trojan written in C/C++. Once executed on an endpoint, it establishes persistence via registry run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and scheduled tasks masquerading as legitimate system update services.
Key capabilities of the PhantomCore backdoor include:
* System Reconnaissance: Automated collection of system hostname, domain membership, user privileges, running processes, and installed security software.
* Credential Harvesting: Dumping saved browser credentials, memory tokens, and LSASS credentials via embedded mimikatz-like routines.
* Command & Control (C2) Communications: Encrypted C2 communications using HTTPS or custom TLS-wrapped TCP protocols, leveraging dynamic DNS domain infrastructure.
* File Operations: Upload, download, execute, and delete arbitrary files on the compromised endpoint.
* Lateral Movement: Automated discovery of internal network shares, active Active Directory domain controllers, and SMB propagation vectors.
Software Supply Chain Hazards in On-Premises SaaS
This campaign underscores a critical architectural hazard: on-premises software installer poisoning. By compromising an internal distribution node (the videoconferencing server), attackers turn a trusted enterprise utility into a Trojan horse. Traditional perimeter defenses fail because the malicious payload is fetched from an internal IP address previously whitelisted by IT teams.
Targeted Industry Sectors & Threat Landscape
Threat intelligence telemetry confirms that Head Mare's campaign specifically targets critical industrial and technology sectors:
* Electronics Manufacturing: High-tech manufacturing facilities in Eastern Europe and Central Asia.
* Transportation & Logistics: Rail freight operators, maritime port authorities, and logistics routing centers.
* Energy Grid Operations: Power generation facilities and regional electrical grid management providers.
* Defense & Aerospace Technology: Defense contractors and military equipment suppliers.
The campaign highlights the shifting nature of hacktivist groups, which increasingly employ advanced APT-level exploits, supply chain compromises, and custom malware frameworks alongside political messaging.
Actionable Mitigations & Defense Playbook
Security teams operating TrueConf Server instances should immediately execute the following defensive measures:
1. Patch TrueConf Server Immediately
Upgrade all TrueConf Server installations to the following patched versions or later:
* TrueConf Server 5.3 Branch: Update to 5.3.9 or higher.
* TrueConf Server 5.4 Branch: Update to 5.4.9 or higher.
* TrueConf Server 5.5 Branch: Update to 5.5.5 or higher.
2. Restrict Network Access to TCP Port 4307
* Block public internet access to TCP port 4307 on all perimeter firewalls.
* Place TrueConf management and client communication ports behind Zero Trust Network Access (ZTNA) or corporate VPN gateways.
* Restrict server access strictly to authorized internal subnet IP ranges.
3. Enforce Cryptographic Code-Signing Verification
* Implement endpoint AppLocker / Software Restriction Policies that enforce valid Authenticode signature checks on all setup executables.
* Block the execution of unsigned setup binaries originating from internal web downloads.
4. Conduct Endpoint & Server Threat Hunting
Search SIEM and EDR logs for the following Indicators of Compromise (IoCs):
* File Hashes (Trojanized Setup Binaries): Audit client installer SHA-256 hashes against original vendor release hashes.
* Suspicious Child Processes: Inspect process trees where TrueConf_Client.exe spawns cmd.exe, powershell.exe, or unrecognised background binaries.
* Registry Persistence: Monitor HKCU\Software\Microsoft\Windows\CurrentVersion\Run for unexpected entries pointing to user profile directories (%APPDATA%, %TEMP%).
Conclusion
The Head Mare campaign targeting TrueConf Server demonstrates the severe risk posed by on-premises communications infrastructure vulnerabilities. By chaining RCE and file-replacement zero-days, attackers convert trusted internal servers into distribution hubs for custom malware like PhantomCore. Proactive patching, port restriction, and code-signing enforcement are essential to mitigating these high-impact supply chain threats.
For more threat intelligence updates and deep-dive vulnerability research, follow DigitalSpying.com.