[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvtUZjsIFZZTk3BM_xZF8Wbr8j1CvmBBPb0swECFuM48":3,"$fw3ZlYyzTDTlPDhFkYCZvrVooqwYU_YqtFBBZmTELo2Q":46},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":43,"created_at":44,"updated_at":45,"published_at":29},"head-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan","Head Mare APT trojanises TrueConf client installers to drop PhantomCore and PhantomGraph backdoors","Kaspersky found the group exploiting TrueConf servers that had not been updated to the 18 June fixes, replacing the hosted client installer with a malicious version that delivers two backdoors.","Kaspersky reports that Head Mare compromised TrueConf video conferencing servers through two flaws that TrueConf fixed on 18 June 2026, then swapped the hosted client installer for a trojanised build delivering the PhantomCore and PhantomGraph backdoors. The campaigns target Russian organisations in six sectors.",[10,11,12,13,14],"Head Mare","TrueConf","PhantomCore","PhantomGraph","APT","# Head Mare APT trojanises TrueConf client installers to drop PhantomCore and PhantomGraph backdoors\n\n*Kaspersky found the group exploiting TrueConf servers that had not been updated to the 18 June fixes, replacing the hosted client installer with a malicious version that delivers two backdoors.*\n\n**Tags:** `Head Mare` `TrueConf` `PhantomCore` `PhantomGraph` `APT`\n\n> Kaspersky reports that Head Mare compromised TrueConf video conferencing servers through two flaws that TrueConf fixed on 18 June 2026, then swapped the hosted client installer for a trojanised build delivering the PhantomCore and PhantomGraph backdoors. The campaigns target Russian organisations in six sectors.\n\n---\n\n## Head Mare trojanises TrueConf client installers\n\nKaspersky detected a new Head Mare campaign in July 2026 targeting TrueConf video conferencing servers, and published its analysis on 11 August 2026. The group chained two flaws, tracked by Kaspersky as KLCERT-26-057 and KLCERT-26-058, to take over the server and replace the legitimate TrueConf Client installer with a malicious version that delivers backdoors.\n\nThe flaws are not zero-days: TrueConf fixed them in TrueConf Server 5.3.9, 5.4.9 and 5.5.5, released on 18 June 2026. Servers running earlier builds are exposed. No CVE identifiers are given in the sources.\n\nKaspersky, which previously described Head Mare as hacktivists, now classifies the group as an APT because of the sophistication of its TTPs, also noting the absence of destructive activity such as encryption or wiping in the targeted infrastructure.\n\n## How the TrueConf server is compromised\n\nThe attacker connects to the target TrueConf server on TCP port 4307, which is open by default, without authorisation. Through a server function (KLCERT-26-057) the attacker submits a script that runs in an isolated environment, then uses the second flaw (KLCERT-26-058) to escape that environment and gain SYSTEM privileges.\n\nThe attacker then replaces the `\\public\\js\\locale.php` file with a web shell. Kaspersky says the web shell was used for reconnaissance, privileged access to the TrueConf database and swapping the hosted TrueConf Client installer for an infected one.\n\n## The backdoor payload: PhantomCore and PhantomGraph\n\nThe trojanised installer delivers the PhantomCore and PhantomGraph backdoors. PhantomGraph consists of two DLLs:\n\n- `SysExcSvc.dll` handles communication with the operators, receiving commands and sending back results;\n- `SysReadSvc.dll` executes the commands passed to it by `SysExcSvc.dll` and saves the output.\n\nThe operators used a Microsoft OneDrive account as the command-and-control channel.\n\nCommands observed by Kaspersky included a memory dump of the LSASS process (lsass.exe), which BleepingComputer describes as an attempt to steal credentials, reconnaissance with `hostname` and `whoami`, and the launch of a reverse SSH tunnel.\n\n## Who is being targeted\n\nKaspersky sees multiple active Head Mare campaigns against Russian organisations in six sectors: instrument manufacturing, electronics, transportation, energy, IT and software development. Besides the TrueConf route, the group gains initial access through phishing, exploitation of public-facing web servers and compromise of a subcontractor.\n\n## Key points\n\n- Head Mare chained two TrueConf Server flaws (KLCERT-26-057 and KLCERT-26-058) to reach SYSTEM on servers not updated to 5.3.9, 5.4.9 or 5.5.5, released on 18 June 2026.\n- The attacker replaced locale.php with a web shell and swapped the hosted TrueConf Client installer for a trojanised build.\n- The installer delivers PhantomCore and PhantomGraph; in PhantomGraph, SysExcSvc.dll talks to the operators and SysReadSvc.dll executes commands.\n- PhantomGraph uses a Microsoft OneDrive account for command and control; observed commands included an LSASS memory dump and a reverse SSH tunnel.\n- Targets are Russian organisations in instrument manufacturing, electronics, transportation, energy, IT and software development.\n- Kaspersky now classifies Head Mare as an APT rather than a hacktivist group.\n\n## Further reading & sources\n\n- [Head Mare delivers PhantomCore and PhantomGraph backdoors via an unpatched TrueConf server | Securelist](https:\u002F\u002Fsecurelist.com\u002Ftr\u002Fhead-mare-targets-trueconf-server-with-phantomcore\u002F120988) — Kaspersky Securelist\n- [Hackers breach TrueConf to trojanize client installers with backdoors](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-breach-trueconf-to-trojanize-client-installers-with-backdoors\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan.png?v=b570cfa52f",{"iocs":18,"actors":24,"malware":30,"timeline":33,"technologies":38},[19,22],{"type":20,"value":21},"other","SysReadSvc.dll",{"type":20,"value":23},"SysExcSvc.dll",[25],{"url":26,"name":10,"slug":27,"type":28,"origin":29,"motivation":29},"\u002Fthreat-groups\u002Fhead-mare","head-mare","unknown",null,[31,32],{"name":12},{"name":13},[34],{"date":35,"event":36,"description":37},"2026-07","Attack Detected","Kaspersky experts detected a new attack by the Head Mare group.",[39,41],{"vendor":11,"product":40},"TrueConf Server",{"vendor":11,"product":42},"TrueConf Client","campaign","2026-08-28T17:23:49.323621+00:00","2026-10-16T12:29:06.730818+00:00",{"articles":47},[48,61,73,85],{"slug":49,"title":50,"summary":51,"tags":52,"hero_image_url":58,"story_type":59,"created_at":60},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.",[53,54,55,14,56,57],"Armored Likho","BusySnake Stealer","Kaspersky","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","threat_actor_activity","2026-09-19T12:06:09.947355+00:00",{"slug":62,"title":63,"summary":64,"tags":65,"hero_image_url":71,"story_type":59,"created_at":72},"honeymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor","HoneyMyte adds kernel-mode rootkit to CoolClient backdoor","Kaspersky reports that HoneyMyte (Mustang Panda) has added a Windows kernel-mode rootkit, msagent.sys, to its CoolClient backdoor. The driver hides the backdoor's process, protects its files and registry entries and filters its C2 addresses from network data. Victims were found in Myanmar, Mongolia, Pakistan and Russia, including government entities.",[66,67,68,69,70,14],"HoneyMyte","Mustang Panda","CoolClient","Msagent.sys","Windows kernel rootkit","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhoneymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor.png?v=81f9bb1ed5","2026-08-29T12:13:55.8896+00:00",{"slug":74,"title":75,"summary":76,"tags":77,"hero_image_url":83,"story_type":43,"created_at":84},"mirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm","Mirage2FA Phishing Kit Linked to 4,500 Potentially Compromised Microsoft 365 Accounts","ANY.RUN has linked the Mirage2FA phishing-as-a-service kit, attributed to a developer called LinX Coders, to 4,532 potentially compromised email addresses across 94 countries. The kit uses an adversary-in-the-middle relay to capture Microsoft 365 credentials, 2FA codes and session cookies.",[78,79,80,81,82],"phishing","m365","aitm","mfa-bypass","us-victims","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm.png?v=66142d32cc","2026-09-17T07:09:37.283462+00:00",{"slug":86,"title":87,"summary":88,"tags":89,"hero_image_url":96,"story_type":43,"created_at":97},"french-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858","French Kubernetes Cluster's Webhook Scan Included n8n CVE-2026-21858 Probes","GreyNoise Labs reported in February 2026 that a Kubernetes scanning cluster on Bucklog SARL's network (AS211590) sent 33,270 sessions at webhook file-upload endpoints between 27 January and 3 February 2026. Forty of those sessions used an n8n-scanner\u002F1.0 user agent aimed at n8n paths associated with CVE-2026-21858.",[90,91,92,93,94,95],"n8n","CVE-2026-21858","webhook","path-traversal","Bucklog","Kubernetes","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffrench-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858.png?v=e7ec932bb4","2026-09-14T12:08:30.244241+00:00"]