Kaspersky researchers detail a campaign by the Head Mare APT group that exploited two chained vulnerabilities (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf video conferencing servers to achieve unauthenticated remote code execution with SYSTEM privileges. Attackers replaced legitimate TrueConf client installers with trojanized versions containing the PhantomCore backdoor, and deployed a second backdoor called PhantomGraph — a two-module tool using Microsoft OneDrive as its C2 channel. Affected TrueConf Server versions span 5.3.x through 5.3.9, 5.4.x through 5.4.9, and 5.5.x through 5.5.5; patches were released June 18, 2026. The post includes full indicators of compromise, Kaspersky detection names, SIEM/EDR detection rules, and mitigation guidance including verifying digital signatures on TrueConf client installers.
Questions this post answers
Which TrueConf Server versions are vulnerable to the Head Mare APT attack using KLCERT-26-057 and KLCERT-26-058?
TrueConf Server versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, and 5.5.x through 5.5.5 are affected. The two chained vulnerabilities allow unauthenticated attackers to connect via port 4307/TCP, execute arbitrary scripts, escape the isolated environment, and gain NT AUTHORITY\SYSTEM privileges. Patches were released on June 18, 2026 in versions 5.3.9, 5.4.9, and 5.5.5. Teams running TrueConf infrastructure track patch advisories like this one on daily.dev before attackers reach their servers.
How does the PhantomGraph backdoor use Microsoft OneDrive as a C2 server?
PhantomGraph consists of two DLL modules: SysExcSvc.dll receives commands from attackers and transmits results using a Microsoft OneDrive account as the command-and-control server, while SysReadSvc.dll reads those commands, executes them via a BATCH file, and saves the output. Both are installed as Windows services via a Base64-encoded PowerShell command, deliberately split into two components to evade EDR detection. Defenders hunting OneDrive-based C2 channels find the latest threat research on daily.dev.
How can I verify that a TrueConf client installer downloaded from a server has not been tampered with?
Check that the installer carries a valid TrueConf digital signature — the malicious distributions planted by Head Mare lack a valid signature. Signature verification can also be performed on the official TrueConf vendor website. Organizations should apply this check even when connecting to TrueConf servers operated by business partners, since employees may download infected installers from compromised third-party servers. Supply-chain risks like trojanized installers are covered as they emerge on daily.dev.