Full research report

CISA orders feds to patch actively exploited TrueConf Server flaws

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

TrueConf's exploitation presents a compounding threat across two geopolitically distinct campaigns targeting different victim sets via different attack surfaces on the same platform. Head Mare's chaining of CVE-2026-72529 and CVE-2026-72530 is operationally significant because it weaponises the conferencing server's own installer distribution mechanism, turning every subsequent meeting into a malware delivery event without requiring additional exploitation — an asymmetric amplification of initial access that bypasses endpoint controls where users trust software from a known internal server. Kaspersky's reclassification of Head Mare from hacktivist group to APT reflects observable tradecraft maturation: the use of Microsoft OneDrive for command-and-control, CLSID hijacking for persistence, and cross-platform Linux backdoors indicate capabilities that exceed typical disruptive hacktivism. Concurrently, the Chinese-nexus Operation TrueChaos campaign demonstrates that TrueConf's on-premises deployment model independently attracted a separate espionage-focused actor exploiting an unrelated client update flaw against Southeast Asian government infrastructure, with ShadowPad co-occurrence suggesting possible broader Chinese APT tooling integration. The convergence of two state-adjacent actors on the same niche video-conferencing platform within a six-month window, each exploiting distinct vulnerabilities against non-overlapping victim sets, underscores TrueConf Server as a high-value, under-patched target in both Russian-adjacent and Asia-Pacific conflict theatres.

What happened

On 20 August 2026, CISA added two critical TrueConf Server vulnerabilities — CVE-2026-72529 (missing authentication) and CVE-2026-72530 (sandbox escape) — to its Known Exploited Vulnerabilities catalogue, ordering federal agencies to patch by 23 August and 3 September 2026 respectively. Kaspersky had published technical analysis on 12 August 2026 documenting that Head Mare APT had been chaining these two flaws since at least July 2026 to replace legitimate TrueConf client installers with trojanised versions delivering PhantomCore and PhantomGraph backdoors. TrueConf released patched server versions (5.3.9, 5.4.9, and 5.5.5) on 18 June 2026, meaning organisations running older versions remained exposed for at least a month before KEV listing. A third, separate TrueConf vulnerability (CVE-2026-3502, TrueConf Client) was exploited in early 2026 in a distinct campaign — Operation TrueChaos — attributed with moderate confidence to a Chinese-nexus actor targeting Southeast Asian government entities.

Affected scope

TrueConf Server versions prior to 5.3.9, 5.4.9, and 5.5.5 (all versions since 2022); TrueConf Client versions 8.1.0–8.5.2 (CVE-2026-3502, fixed in 8.5.3). Known targeted sectors include Russian instrumentation, electronics, transportation, energy, IT, and software development organisations, and government agencies across Southeast Asia.

Technical assessment

CVE-2026-72529 exposes an unauthenticated service listener on TCP port 4307 that accepts calls to an undocumented function, enabling arbitrary script execution without any credentials (CVSS 9.8). CVE-2026-72530 then permits an attacker who has achieved script execution inside TrueConf's isolated environment to escape that sandbox via improper code-generation management and gain OS-level command execution as NT AUTHORITY\SYSTEM (CVSS 9.0). Head Mare chained these two flaws sequentially to weaponise the server's own client-distribution mechanism — replacing the installer files served to meeting participants — effectively converting the conferencing platform into a supply-chain malware delivery vector with no further exploitation required on individual endpoints. Separately, CVE-2026-3502 exploits insufficient integrity verification in TrueConf Client's update mechanism, allowing an attacker controlling an on-premises server to distribute and execute arbitrary payloads on every connected client.

Recommended defensive actions

  1. Patch TrueConf Server immediately to version 5.3.9, 5.4.9, or 5.5.5; FCEB agencies must remediate CVE-2026-72529 by 23 August 2026 and CVE-2026-72530 by 3 September 2026.
  2. Update TrueConf Client to version 8.5.3 or later to remediate CVE-2026-3502.
  3. Audit TrueConf Server installations for signs of compromise: check for unexpected modification of client installer files, presence of a web shell at locale.php, and Windows services named SysExcSvc or SysReadSvc.
  4. Block or restrict inbound access to TCP port 4307 from untrusted network segments where TrueConf Server does not require external reachability.
  5. Monitor for anomalous outbound connections to Microsoft OneDrive or GitHub originating from TrueConf server processes, as both were abused for command-and-control in the Head Mare campaign.
  6. Hunt for CLSID persistence under HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 on endpoints that installed TrueConf client updates since July 2026.
  7. Verify the cryptographic integrity of TrueConf client installer binaries served from on-premises servers before permitting installation across the organisation.

Uncertainties and evidence gaps

  • CISA did not publicly attribute exploitation of CVE-2026-72529 and CVE-2026-72530 to any specific actor; Head Mare attribution rests solely on Kaspersky's reporting and has not been independently corroborated by other vendors.
  • Head Mare's reclassification from hacktivist collective to APT by Kaspersky is not yet confirmed by other threat intelligence vendors, and no state nexus has been formally assessed.
  • The exact number and identity of organisations compromised beyond those identified in Kaspersky's Russia-focused investigation is unknown.
  • The BleepingComputer article implies a single 3 September deadline for both CVEs, while SecurityWeek and The Record report separate deadlines (23 August for CVE-2026-72529, 3 September for CVE-2026-72530); the latter appear more accurate but could not be directly verified from the CISA alert page (HTTP 403).
  • Whether Head Mare gained access to CVE details before or after TrueConf's June 18 patch release — indicating potential zero-day exploitation versus exploitation of a known-patched flaw — has not been confirmed.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNetwork-reachable TrueConf Server; no authentication required to reach the vulnerable service on TCP port 4307
ComponentTrueConf Server internal service listener on TCP 4307 and its sandboxed script-execution environment
MechanismAn undocumented function is callable without credentials via the service listener, enabling arbitrary script execution; a separate code-generation management flaw then permits escape from the isolated execution environment to the underlying host OS
ImpactUnauthenticated attackers achieve OS-level command execution on the TrueConf Server host, enabling replacement of client installer files and malware distribution to all subsequent meeting participants
DetectionAnomalous connections to TCP 4307 from external or unexpected hosts; unexpected modification timestamps on client installer files; locale.php web shell present in TrueConf web root; Windows services SysExcSvc or SysReadSvc running; OneDrive or GitHub network traffic from TrueConf server processes
MitigationUpgrade TrueConf Server to version 5.3.9, 5.4.9, or 5.5.5; restrict network access to TCP port 4307 to authorised internal hosts only
Exploitation status

Confirmed active exploitation in the wild; Head Mare APT has exploited CVE-2026-72529 and CVE-2026-72530 since at least July 2026 to trojanise TrueConf client installers with PhantomCore and PhantomGraph backdoors, primarily against Russian organisations; CISA added both to its Known Exploited Vulnerabilities catalogue on 20 August 2026.

Research process

Investigation began with three CISA KEV-listed CVEs and a BleepingComputer report attributing exploitation to Head Mare. Fetching TrueConf's vendor advisory confirmed fixed version boundaries and CVSS scores as primary authority. Two Kaspersky publications provided independent technical detail on the attack chain, malware families, persistence mechanisms, and targeted sectors. Check Point Research independently confirmed a parallel campaign (Operation TrueChaos) attributing CVE-2026-3502 to a Chinese-nexus actor against Southeast Asian governments — a separate threat thread on the same platform. SecurityWeek and The Record resolved a deadline discrepancy in the original reporting, establishing that each CVE carries a distinct remediation window.

  1. What does the assigned BleepingComputer article report about these CVEs, attribution, and CISA's action?
    Fetched BleepingComputer CISA TrueConf article
    bleepingcomputer.com ↗

    Confirmed CVE-2026-72529 (unauthenticated RCE via TCP 4307) and CVE-2026-72530 (sandbox escape). Head Mare attributed by Kaspersky; September 3 deadline stated; also noted Operation TrueChaos and Chinese actor exploitation of CVE-2026-3502 as context.

    why Established the primary reported narrative and identified all CVEs, actors, and linked primary sources for follow-up verification.

  2. Is CISA's KEV addition confirmed by independent sources, and what are the precise remediation deadlines?
    Searched for CISA KEV entries for CVE-2026-72529 and CVE-2026-72530

    Multiple credible outlets (SecurityWeek, Security Affairs, SC Media) independently reported KEV addition on 20 August 2026. SecurityWeek specified separate deadlines: 23 August for CVE-2026-72529 and 3 September for CVE-2026-72530.

    why Corroborated KEV additions across independent domains; resolved a deadline discrepancy in the BleepingComputer article.

  3. What do TrueConf's own advisories say about affected versions, CVSS scores, and technical descriptions?
    Fetched TrueConf vendor advisory page
    trueconf.com ↗

    CVE-2026-72529 CVSS 9.8, affects all versions <5.3.9/5.4.9/5.5.5; CVE-2026-72530 CVSS 9.0, same fix boundary; CVE-2026-3502 CVSS 7.8, TrueConf Client 8.1.0–8.5.2, fixed in 8.5.3.

    why Vendor advisory is the authoritative source for version scope and severity ratings; confirmed and expanded on news reporting.

  4. What technical detail does Kaspersky's ICS CERT report provide on Head Mare's exploitation of TrueConf?
    Searched for Kaspersky Head Mare PhantomCore reporting; fetched Kaspersky ICS CERT report
    ics-cert.kaspersky.com ↗

    Head Mare chained both CVEs from July 2026, gaining SYSTEM privileges and replacing installer files with PhantomCore/PhantomGraph-laden versions; C2 via OneDrive and GitHub; targeted Russian industrial sectors; CLSID registry persistence on endpoints.

    why Primary technical source on Head Mare's TTPs; confirmed the supply-chain-style installer replacement and identified actionable threat-hunting indicators.

  5. Does the Securelist report add detail beyond the ICS CERT report?
    Fetched Securelist Head Mare report
    securelist.com ↗

    Corroborated ICS CERT attack chain; added Head Mare's formal reclassification from hacktivist to APT, Linux server-side backdoor variants, and the specific CLSID persistence key.

    why Second independent Kaspersky source strengthening confidence in the Head Mare attribution and adding concrete threat-hunting data.

  6. What does Check Point Research say about CVE-2026-3502 and Operation TrueChaos?
    Searched for Check Point Operation TrueChaos; fetched Check Point Research report
    research.checkpoint.com ↗

    CVE-2026-3502 exploited as a zero-day in early 2026 by a Chinese-nexus actor against Southeast Asian government agencies using Havoc C2 and DLL sideloading; Alibaba Cloud and Tencent infrastructure; ShadowPad co-occurrence noted. Fixed in TrueConf Client 8.5.3.

    why Established the Chinese-attributed campaign as a separately verified threat thread, distinct from Head Mare, demonstrating that TrueConf has been targeted by two geopolitically distinct actors within the same period.

  7. Do SecurityWeek and The Record provide independent corroboration of the CISA KEV deadlines and Head Mare attribution?
    Fetched SecurityWeek and The Record articles on TrueConf CISA patching
    securityweek.com ↗

    SecurityWeek confirmed separate deadlines and corroborated Head Mare targeting of Russian/Belarusian organisations; The Record confirmed CVE-2026-72529's 23 August deadline and provided CVE-2026-3502 context.

    why Two independent outlets from different domains confirmed the key facts, satisfying the requirement for independent corroboration from separate source domains.

Named in this story
ActorsHead Mare APTChinese-nexus threat actor (unattributed, Operation TrueChaos)
MalwarePhantomCorePhantomGraph (SysExcSvc.dll / SysReadSvc.dll)Havoc C2 frameworkPHP web shell (locale.php)
TargetsRussian organisations in instrumentation, electronics, transportation, energy, IT and software developmentSoutheast Asian government entitiesUS Federal Civilian Executive Branch agencies
Related CVEs CVE-2026-72529CVE-2026-72530CVE-2026-3502

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok9 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
CISA KEVkev ok1674 records Primary evidence3 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok7871 records Context3 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5332 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok686 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok11 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
Vulnerability & exploitation6
CVE-2026-72530 CISA KEV TrueConf Server · added 2026-08-20 CISA catalog ↗
CVE-2026-72529 CISA KEV TrueConf Server · added 2026-08-20 CISA catalog ↗
CVE-2026-3502 CISA KEV TrueConf Client · added 2026-04-02 CISA catalog ↗
CVE-2026-3502 EPSS 5.8% 92th percentile exploitation probability
CVE-2026-72529 EPSS 0.8% 53th percentile exploitation probability
CVE-2026-72530 EPSS 1.0% 59th percentile exploitation probability
Vendor & gov advisories1
TrueConf Security Vulnerabilities, Fixes and Advisories trueconf.com ↗

Vendor advisory confirming CVE-2026-72529 (CVSS 9.8), CVE-2026-72530 (CVSS 9.0), and CVE-2026-3502 (CVSS 7.8) with fixed version numbers.

Analysis & research5
Head Mare APT Group exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware — Kaspersky ICS CERT ics-cert.kaspersky.com ↗

Primary Kaspersky ICS CERT technical report detailing the full attack chain, malware payloads, C2 infrastructure, and targeted sectors.

Head Mare delivers PhantomCore and PhantomGraph backdoors via an unpatched TrueConf server — Securelist securelist.com ↗

Kaspersky Global Research analysis corroborating attack chain, persistence via CLSID hijacking, and Head Mare's reclassification to APT.

Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets — Check Point Research research.checkpoint.com ↗

Independent primary research confirming Chinese-nexus exploitation of CVE-2026-3502 via Havoc C2 against Southeast Asian government entities.

CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities — SecurityWeek securityweek.com ↗

Independent corroboration of KEV deadlines; clarifies separate remediation dates for CVE-2026-72529 (23 August) versus CVE-2026-72530 (3 September).

CISA orders feds to patch actively exploited TrueConf Server flaws — BleepingComputer bleepingcomputer.com ↗

Primary news report with direct vendor quotes and CISA attribution; the assigned source for this story.