Executive Summary
Cybersecurity researchers at Kaspersky have uncovered an ongoing cyber-espionage campaign executed by the hacktivist group Head Mare, targeting organizations across energy, transportation, defense, and IT sectors. The attackers exploited unpatched vulnerabilities in TrueConf Server—a widely deployed enterprise video conferencing platform—to breach servers via open TCP ports, escape isolated sandboxes, escalate privileges to NT AUTHORITY\SYSTEM, and trojanize client software installers with persistent backdoors (PhantomCore and PhantomGraph).
Technical Analysis
The campaign targets a specific range of enterprise infrastructure to establish long-term persistence and data exfiltration capabilities.
* Target Platform: TrueConf Server (versions 5.3.x prior to 5.3.9, 5.4.x prior to 5.4.9, and 5.5.x prior to 5.5.5).
* Initial Access Vector: Unauthenticated connections to default TCP port 4307 on public-facing or internally accessible TrueConf servers.
Exploit Execution Chain
The following table outlines the sequential stages of the attack utilized by Head Mare:
Phase
Vulnerability / Action
Description
1
Remote Code Execution
Leveraging unauthenticated endpoint KLCERT-26-057 to execute arbitrary scripts in the execution container.
2
Sandbox Escape
Execution of secondary commands (KLCERT-26-058) to break out of the container onto the host OS.
3
Privilege Escalation
Escalation of system access to NT AUTHORITY\SYSTEM administrative privileges.
4
Persistence
Replacing \public\js\locale.php with web shells and trojanizing installers with PhantomCore/PhantomGraph.
Industry Impact & Recommendations
The reach of this campaign spans critical infrastructure and private sector technology providers, requiring immediate defensive action.
Affected Sectors
* Enterprise organizations and government institutions.
* Defense contractors and energy sector providers.
* On-premise TrueConf video conferencing infrastructure users.
Mitigation Directives
1. Apply Emergency Upgrades: Update all TrueConf Server deployments immediately to versions 5.3.9, 5.4.9, 5.5.5, or higher.
2. Network Perimeter Hardening: Restrict public internet access to TrueConf TCP port 4307 and enforce VPN/MFA gateways for remote video conference access.
3. Installer Verification: Re-verify and recalculate cryptographic hash signatures for all TrueConf client installers distributed to end-user workstations.
4. Endpoint Threat Hunting: Scan endpoint devices for indicator-of-compromise (IoC) artifacts associated with PhantomCore and PhantomGraph backdoor payloads.