Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive adding two actively exploited security vulnerabilities in TrueConf Server—tracked as CVE-2026-72529 (CVSS score 9.3) and CVE-2026-72530—to its Known Exploited Vulnerabilities (KEV) Catalog. The action follows threat intelligence disclosures from Kaspersky revealing that a pro-Ukrainian hacktivist cluster tracked as "Head Mare" has been chaining these flaws in active in-the-wild campaigns. Threat actors exploit unauthenticated network interfaces on TrueConf on-premises video-conferencing servers to execute arbitrary scripts with SYSTEM privileges, plant web shells, and replace legitimate TrueConf client installers with trojanized versions delivering the PhantomCore and PhantomGraph backdoors.
Vulnerability ID
CVSS
Primary Impact
CVE-2026-72529
9.3
Unauthenticated Critical Function Execution
CVE-2026-72530
N/A
Privilege Abuse and Persistence via Web Shells
Deep-Dive Technical Analysis
The vulnerability chain combines missing authentication with supply-chain poisoning of legitimate enterprise software distribution:
1. Unauthenticated Critical Function Execution (CVE-2026-72529): TrueConf Server versions 5.3.x through 5.5.5 expose an unauthenticated communication port on TCP 4307. Remote, unauthenticated attackers can send crafted network packets to invoke undocumented internal functions, executing arbitrary server-side scripts with elevated NT AUTHORITY\SYSTEM or root permissions.
2. Privilege Abuse and Persistence (CVE-2026-72530): By chaining access with secondary administrative components, attackers deploy persistent web shells into the server's web root directory, establishing robust interactive command access.
3. Installer Trojanization (PhantomCore): Once administrative control is established over the TrueConf Server, the "Head Mare" operators replace the legitimate TrueConf Client installer files hosted on the server's public distribution endpoints with malicious, backdoored binaries.
4. Trojanized Software Distribution: When legitimate internal employees or external meeting participants connect to the conference server and download routine software updates, the poisoned installer silently deploys PhantomCore (an evasive remote access trojan).
5. OneDrive Cloud Command & Control (PhantomGraph): The attack chain deploys a secondary backdoor, PhantomGraph, which leverages legitimate Microsoft OneDrive API webhooks as its covert C2 channel, completely blending malicious traffic with benign cloud synchronization requests.
Industry Impact
* Video Conferencing as an Initial Access Vector: On-premises video conferencing solutions are high-value targets because they necessarily bridge internal corporate subnets with external public networks, allowing threat actors to achieve cross-boundary pivoting.
* Enterprise-Wide Endpoint Infiltration: By poisoning the centralized software distribution point, attackers transform a trusted internal enterprise application into a mass distribution vehicle for info-stealers across corporate workstations.
* Critical Infrastructure Disruption: Observed campaigns have targeted transportation, energy, electronics, and IT organizations, exfiltrating meeting transcripts, employee credentials, and intellectual property.
Recommendations and Mitigations
1. Apply Emergency TrueConf Updates: Upgrade all TrueConf Server deployments to version 5.5.6 or later immediately, in compliance with CISA's binding remediation timeline.
2. Restrict Port 4307 Access: Place TrueConf administrative and internal API ports (specifically TCP 4307) behind strict firewall rules, accessible only via trusted VPN gateways or isolated management VLANs.
3. Installer Hash Integrity Verification: Inspect and verify the cryptographic signatures and SHA-256 hashes of all hosted TrueConf client installation binaries against official vendor-published checksums.
4. Cloud Storage API Monitoring: Monitor enterprise network egress traffic for anomalous spikes in Microsoft Graph / OneDrive API requests originating from non-standard processes or meeting software paths.
Reviewing Official: Person
Remediation Deadline: Date