Critical TrueConf Server Flaws Let Attackers Push Malware via Updates

Key Takeaways

• The Head Mare APT group exploited critical vulnerabilities in TrueConf Server to distribute PhantomCore malware.
• Attackers leveraged two flaws (KLCERT-26-057 and KLCERT-26-058) to gain full system control and push malicious updates.
• Compromised TrueConf servers delivered infected client installers, impacting both Windows and Linux users.
• TrueConf patched these vulnerabilities in server versions 5.3.9, 5.4.9, and 5.5.5, released on June 18, 2026.
• Organizations must update immediately and scan for indicators of compromise.

Cybersecurity researchers at Kaspersky have uncovered a sophisticated campaign orchestrated by the advanced persistent threat (APT) group known as Head Mare. The group exploited critical vulnerabilities within TrueConf Server, a popular video conferencing solution, to covertly bundle its PhantomCore malware with legitimate client installers. These malicious packages were then distributed directly from compromised TrueConf servers belonging to victim organizations, lending a deceptive air of legitimacy to the downloads.

Exploiting TrueConf Servers

The attackers chained together two distinct vulnerabilities to achieve arbitrary code execution on TrueConf servers. Internally tracked by Kaspersky as KLCERT-26-057 and KLCERT-26-058, these flaws provided a pathway for the sophisticated attack.

The first vulnerability, KLCERT-26-057, allowed an unauthenticated attacker to connect to TCP port 4307 and invoke an undocumented function. This action facilitated the execution of a malicious script on the server. Subsequently, KLCERT-26-058 enabled attackers to bypass the isolated execution environment, escalating privileges to NT AUTHORITYSYSTEM. This critical step granted them complete control over the compromised server.

With system-level access secured, the threat actors replaced a legitimate server file with a malicious web shell. This web shell became their primary tool for mapping the victim’s IT infrastructure, gaining privileged access to databases, and ultimately substituting authentic client installers with their infected versions.

Multi-Platform Malware Deployment

The Head Mare group tailored its attack for different operating systems. On Windows systems, they deployed backdoor services named SysExcSvc and SysReadSvc. These services leveraged Microsoft OneDrive as a command-and-control (C2) channel for communication.

For Linux environments, a separate backdoor was utilized. This Linux-specific malware was designed to conceal its files, intercept TrueConf network traffic, and employ GitHub for its command-and-control infrastructure.

Users joining video calls hosted on a compromised TrueConf server were prompted to download a “new client application.” This installer silently deployed the legitimate TrueConf client alongside a hidden PhantomCore payload, disguised as a DLL. This granted attackers remote command execution capabilities and full control over the infected workstation. To ensure persistence, a registry key was created, guaranteeing the malware’s automatic launch at every system startup. Kaspersky warns that even organizations not directly operating TrueConf servers could be at risk if their employees join meetings hosted on compromised third-party or contractor servers.

Patch and Remediation

TrueConf addressed both vulnerabilities, releasing patches in server versions 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026. Kaspersky’s internal analysis revealed that all TrueConf server versions released since 2022 were vulnerable prior to this patch. The vendor is actively informing administrators to update their systems immediately, while Kaspersky continues to coordinate disclosure efforts and provide remediation support.

What You Should Do

• Update TrueConf Servers: Immediately update all TrueConf servers to patched versions 5.3.9, 5.4.9, or 5.5.5, or newer.
• Scan for Indicators of Compromise (IoCs): Conduct thorough scans of your environment for the IoCs Kaspersky published. This includes specific file hashes (e.g., malicious TrueConf installer MD5: 748c9f8cb1065000616204935f96207f, PhantomCore MD5: c5a460e4e68a088f6e51b2c6474642ec), suspicious file paths (e.g., C:WindowsSystem32inetsrvSysExcSvc.dll), malicious domains (e.g., penzadogshelter[.]site), and unusual service names like SysExcSvc and SysReadSvc.
• Run Antivirus Scans: Perform full antivirus scans with updated definitions across all endpoints and servers.
• Reset Passwords: Reset passwords for any accounts suspected of exposure or compromise.
• Monitor Network Traffic: Look for outbound connections to suspicious IP addresses (e.g., 81.177.32[.]12, 194.87.239[.]71) and domains associated with the attack.
• Contact Kaspersky: If indicators of compromise are found, Kaspersky recommends contacting its ICS CERT team for further investigation support.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.