Full research report

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

Head Mare, a hacktivist group targeting Russia since at least 2022, exploited an unauthenticated port exposure (TCP 4307) on TrueConf servers to chain two vulnerabilities — unauthenticated remote script injection (KLCERT-26-057) and sandbox escape (KLCERT-26-058) — achieving full SYSTEM-level control of the host. The most operationally significant step is replacing the server-hosted TrueConf client installer with a trojanised version, effectively converting the organisation's own internal update infrastructure into a malware distribution channel for every connected user. PhantomGraph's deliberate architectural split into two Windows services, with Microsoft OneDrive as command-and-control, represents a studied attempt to evade endpoint detection tooling. Critically, vendor patches were available for five to six weeks before observed exploitation, confirming that patch lag — not zero-day exposure — was the primary enabler. CVE-2026-3502, though thematically linked via shared product and supply-chain technique, is a distinct TrueConf client vulnerability exploited by a separate China-nexus actor against Southeast Asian governments and should not be conflated with the Head Mare server campaign.

What happened

In July 2026, Kaspersky detected Head Mare — a hacktivist group active since at least 2022 — exploiting a two-step vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf Server deployments to gain unauthenticated SYSTEM-level access and replace legitimate client installers with trojanised versions delivering PhantomCore and PhantomGraph. The technique weaponises the software update trust path: employees connecting to their organisation's internal TrueConf server unknowingly download malware-laced clients. Vendor patches for TrueConf Server were released on 18 June 2026 — approximately five to six weeks before Kaspersky observed exploitation — indicating targets had failed to apply available updates.

Affected scope

TrueConf Server versions 5.3.x prior to 5.3.9, 5.4.x prior to 5.4.9, and 5.5.x prior to 5.5.5, deployed in Russian organisations across instrumentation, electronics, transport, energy, IT and software development sectors. End-user TrueConf clients connecting to any compromised server are at risk of receiving trojanised installers. Separately, TrueConf Windows Client versions 8.1.0 to 8.5.2 are affected by CVE-2026-3502, exploited by a distinct actor targeting Southeast Asian government networks.

Technical assessment

KLCERT-26-057 describes a lack of authentication on TCP port 4307 (open by default) that permits an attacker to submit a malicious script for execution within an isolated server environment. KLCERT-26-058 is a sandbox-escape flaw enabling that script to break containment and execute arbitrary commands as NT AUTHORITY\SYSTEM. Attackers subsequently overwrite locale.php with a web shell for persistent re-entry, harvest credential data from the TrueConf database, and substitute the hosted client installer with a PhantomCore-laden version. PhantomGraph, deployed as two Windows services (SysExcSvc.dll receiving commands and SysReadSvc.dll executing them), uses Microsoft OneDrive as a command-and-control channel to blend malicious traffic with legitimate cloud activity — a deliberate split design intended to frustrate endpoint detection. The attack chain also includes LSASS memory dumping and SSH reverse tunnelling. CVE-2026-3502 is a separate CWE-494 flaw in the TrueConf client's update mechanism exploited in an unrelated campaign to deliver the Havoc post-exploitation framework.

Recommended defensive actions

  1. Patch TrueConf Server immediately to versions 5.3.9, 5.4.9, or 5.5.5 (released 18 June 2026) across all on-premises deployments.
  2. Update TrueConf Windows Client to version 8.5.3 or later to remediate CVE-2026-3502.
  3. Restrict TCP port 4307 on TrueConf Server hosts to trusted network segments via host-based or perimeter firewall rules.
  4. Inspect the TrueConf Server path public/js/locale.php for unauthorised modifications and audit all hosted client installers for digital-signature validity before distribution.
  5. Hunt for PhantomCore and PhantomGraph indicators: registry CLSID {0340F119-A598-4ed9-B0AC-6F6A12D3E755}, Windows services named SysExcSvc and SysReadSvc, anomalous OneDrive API calls originating from server-side TrueConf processes, SSH reverse-tunnel connections to 194.87.239[.]71 and 194.87.93[.]153, and LSASS dump artefacts.
  6. Monitor for unsigned TrueConf client executables served from internal servers and validate installer hashes against the vendor's published checksums.

Uncertainties and evidence gaps

  • No CVE identifiers have been publicly assigned to KLCERT-26-057 or KLCERT-26-058; NVD records were not located at time of writing.
  • The full breadth of victim organisations from the July 2026 Head Mare campaign has not been disclosed.
  • CVE-2026-3502 is attributed by Check Point to a China-nexus actor with only moderate confidence; no second independent source has corroborated the attribution.
  • It is unknown whether the PhantomGraph OneDrive command-and-control accounts identified by Kaspersky remain active or have been suspended.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access to TrueConf Server TCP port 4307, which is open by default and reachable from any host that can connect to the server
ComponentTrueConf Server internal service listener on port 4307 and the server-hosted client installer distribution mechanism
MechanismAn unauthenticated function (KLCERT-26-057) accepts attacker-supplied scripts for execution in an isolated environment; a subsequent sandbox-escape flaw (KLCERT-26-058) allows the attacker to break containment and run arbitrary commands at the operating system level with no further authentication
ImpactFull host compromise at NT AUTHORITY\SYSTEM privilege, persistent web-shell access, database credential harvesting, and supply-chain-style malware delivery to every TrueConf client that downloads an update from the compromised server
DetectionUnexpected writes to TrueConf Server public/js/locale.php; unsigned or hash-mismatched TrueConf client installer binaries served from internal servers; new Windows services SysExcSvc and SysReadSvc; anomalous OneDrive API calls from server-side TrueConf processes; LSASS dump artefacts; outbound SSH connections to attacker-controlled IP addresses
MitigationUpgrade TrueConf Server to versions 5.3.9, 5.4.9, or 5.5.5 (patched 18 June 2026) and restrict TCP port 4307 to trusted hosts via firewall rules
Exploitation status

Confirmed active exploitation of KLCERT-26-057 and KLCERT-26-058 by Head Mare against Russian organisations, detected in July 2026; CVE-2026-3502 (a distinct TrueConf Client flaw) was previously exploited in the wild by a separate China-nexus actor and added to the CISA KEV catalogue on 2 April 2026.

Research process

The investigation began by verifying the primary reporting article, then pursued three evidence threads: the Head Mare actor and its PhantomCore and PhantomGraph tooling (corroborated by Kaspersky's own SecureList advisory and BleepingComputer), the technical details of KLCERT-26-057 and KLCERT-26-058 (confirmed through Kaspersky's detailed report), and the stated CVE-2026-3502 (found to relate to a distinct China-nexus campaign exploiting a different flaw — the TrueConf client's update integrity check — documented by Check Point and confirmed via CISA KEV). The story is verified with high confidence for the Head Mare server-side chain; CVE-2026-3502 is a contextually related but separate exploitation event that the headline conflates with the Head Mare campaign.

  1. What does the primary reporting article claim, and which facts require independent verification?
    Fetched the Hacker News article to extract structured claims about the vulnerability chain, malware families, actor, affected versions, and patch dates.
    thehackernews.com ↗

    Confirmed Head Mare, KLCERT-26-057 and KLCERT-26-058, PhantomCore and PhantomGraph, affected server versions 5.3.x to 5.5.x, and June 2026 patch dates. CVE-2026-3502 mentioned as a contextually related prior event attributed to a different actor.

    why Establishes the full claim set and flags that CVE-2026-3502 may represent a separate campaign requiring disambiguation before inclusion.

  2. What is CVE-2026-3502 precisely, and does it correspond to the Head Mare server-side chain?
    Searched for CVE-2026-3502 and fetched the OpenCVE vulnerability record.
    app.opencve.io ↗

    CVE-2026-3502 is a CWE-494 flaw in TrueConf Windows Client (versions 8.1.0 to 8.5.2), CVSS 7.8, patched in client version 8.5.3. Added to CISA KEV on 2 April 2026. It is a client-side update-integrity flaw, wholly distinct from the server-side KLCERT vulnerabilities exploited by Head Mare.

    why Establishes that CVE-2026-3502 belongs to a different campaign and product layer, preventing conflation with the Head Mare server intrusion.

  3. What are the confirmed technical details of Operation TrueChaos and CVE-2026-3502 exploitation?
    Fetched Help Net Security coverage and the Check Point Research advisory for Operation TrueChaos.
    research.checkpoint.com ↗

    Check Point confirmed CVE-2026-3502 was exploited as a zero-day against Southeast Asian government entities since early 2026 by a China-nexus actor (moderate confidence attribution based on Alibaba and Tencent infrastructure); final-stage payload was the Havoc open-source post-exploitation framework.

    why Provides independent primary-source verification of CVE-2026-3502 as a distinct campaign and confirms its geographic and sectoral targeting is entirely separate from Head Mare's Russian focus.

  4. Is there independent corroboration of the Head Mare TrueConf server campaign beyond a single outlet?
    Fetched the BleepingComputer article published 8 August 2026.
    bleepingcomputer.com ↗

    BleepingComputer independently confirmed Head Mare's exploitation of KLCERT-26-057 and KLCERT-26-058, PhantomCore and PhantomGraph malware, affected TrueConf Server versions, and the 18 June patch date, citing Kaspersky's SecureList report as the originating research.

    why A second major security publication corroborating the same technical facts from a named primary source raises assessment confidence to high.

  5. What ground-truth technical detail and indicators of compromise does Kaspersky's own advisory provide?
    Located and fetched the Kaspersky SecureList report directly.
    securelist.ru ↗

    Confirmed KLCERT-26-057 as 'lack of authentication for critical function' and KLCERT-26-058 as 'sandbox escape'; provided PhantomCore registry persistence CLSID {0340F119-A598-4ed9-B0AC-6F6A12D3E755}, PhantomGraph service names SysExcSvc and SysReadSvc, C2 IPs 194.87.239[.]71 and 194.87.93[.]153, OneDrive-based C2 mechanism, and Kaspersky detection verdict names.

    why The vendor's own primary research report provides ground-truth IoCs and technical depth essential for accurate defensive guidance and confirms all material claims in secondary reporting.

Named in this story
ActorsHead MareOperation TrueChaos (China-nexus, unattributed with high confidence)
MalwarePhantomCorePhantomGraphSysExcSvc.dllSysReadSvc.dllHavoc
TargetsRussian organisations in instrumentation, electronics, transport, energy, IT and software development sectorsSoutheast Asian government entities (CVE-2026-3502 / Operation TrueChaos campaign)
Related CVEs CVE-2026-3502

Research coverage

All 68 registered source leaves were evaluated for this run: 58 completed, 0 were unavailable, 3 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 53 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
CISA KEVkev ok1662 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
The Hacker Newsnews ok8 records Primary evidence1 matched items Published the source report used to frame and date the event.
BleepingComputernews ok10 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok7588 records Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5322 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok678 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1008 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok16 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1453 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch failed3 records Failed The current collection attempt failed; this source cannot support the report.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-3502 CISA KEV TrueConf Client · added 2026-04-02 CISA catalog ↗
CVE-2026-3502 EPSS 5.8% 92th percentile exploitation probability
Vendor & gov advisories2
Kaspersky SecureList: Head Mare Targets TrueConf Server with PhantomCore securelist.ru ↗

Primary technical source; details KLCERT-26-057 and KLCERT-26-058, PhantomCore and PhantomGraph malware, IoCs, C2 IPs, and Kaspersky detection verdicts.

Check Point Research: Operation TrueChaos — Zero-Day Exploitation Against Southeast Asian Government Targets research.checkpoint.com ↗

Primary advisory for CVE-2026-3502; describes a distinct China-nexus campaign deploying Havoc against Southeast Asian governments via trojanised TrueConf client updates.

Analysis & research3
BleepingComputer: Hackers Breach TrueConf to Trojanize Client Installers with Backdoors bleepingcomputer.com ↗

Independent corroboration of the Head Mare server campaign; confirms KLCERT IDs, affected versions, and June 2026 patch date.

Help Net Security: TrueConf Zero-Day Vulnerability Exploited in Cyber Espionage helpnetsecurity.com ↗

Covers CVE-2026-3502 CISA KEV addition and the Operation TrueChaos client exploitation context as a distinct event.

OpenCVE: CVE-2026-3502 Vulnerability Record app.opencve.io ↗

Confirms CVSS 7.8, CWE-494, CISA KEV inclusion on 2 April 2026, and affected TrueConf Client versions 8.1.0 to 8.5.2.