Head Mare trojanises TrueConf client installers
Kaspersky detected a new Head Mare campaign in July 2026 targeting TrueConf video conferencing servers, and published its analysis on 11 August 2026. The group chained two flaws, tracked by Kaspersky as KLCERT-26-057 and KLCERT-26-058, to take over the server and replace the legitimate TrueConf Client installer with a malicious version that delivers backdoors.
The flaws are not zero-days: TrueConf fixed them in TrueConf Server 5.3.9, 5.4.9 and 5.5.5, released on 18 June 2026. Servers running earlier builds are exposed. No CVE identifiers are given in the sources.
Kaspersky, which previously described Head Mare as hacktivists, now classifies the group as an APT because of the sophistication of its TTPs, also noting the absence of destructive activity such as encryption or wiping in the targeted infrastructure.
How the TrueConf server is compromised
The attacker connects to the target TrueConf server on TCP port 4307, which is open by default, without authorisation. Through a server function (KLCERT-26-057) the attacker submits a script that runs in an isolated environment, then uses the second flaw (KLCERT-26-058) to escape that environment and gain SYSTEM privileges.
The attacker then replaces the \public\js\locale.php file with a web shell. Kaspersky says the web shell was used for reconnaissance, privileged access to the TrueConf database and swapping the hosted TrueConf Client installer for an infected one.
The backdoor payload: PhantomCore and PhantomGraph
The trojanised installer delivers the PhantomCore and PhantomGraph backdoors. PhantomGraph consists of two DLLs:
SysExcSvc.dllhandles communication with the operators, receiving commands and sending back results;SysReadSvc.dllexecutes the commands passed to it bySysExcSvc.dlland saves the output.
The operators used a Microsoft OneDrive account as the command-and-control channel.
Commands observed by Kaspersky included a memory dump of the LSASS process (lsass.exe), which BleepingComputer describes as an attempt to steal credentials, reconnaissance with hostname and whoami, and the launch of a reverse SSH tunnel.
Who is being targeted
Kaspersky sees multiple active Head Mare campaigns against Russian organisations in six sectors: instrument manufacturing, electronics, transportation, energy, IT and software development. Besides the TrueConf route, the group gains initial access through phishing, exploitation of public-facing web servers and compromise of a subcontractor.
Key points
- Head Mare chained two TrueConf Server flaws (KLCERT-26-057 and KLCERT-26-058) to reach SYSTEM on servers not updated to 5.3.9, 5.4.9 or 5.5.5, released on 18 June 2026.
- The attacker replaced locale.php with a web shell and swapped the hosted TrueConf Client installer for a trojanised build.
- The installer delivers PhantomCore and PhantomGraph; in PhantomGraph, SysExcSvc.dll talks to the operators and SysReadSvc.dll executes commands.
- PhantomGraph uses a Microsoft OneDrive account for command and control; observed commands included an LSASS memory dump and a reverse SSH tunnel.
- Targets are Russian organisations in instrument manufacturing, electronics, transportation, energy, IT and software development.
- Kaspersky now classifies Head Mare as an APT rather than a hacktivist group.