Head Mare APT Group Exploits TrueConf Vulnerabilities to Deploy PhantomCore Malware
In July 2026, Kaspersky experts uncovered a sophisticated attack attributed to the Head Mare group, previously classified as hacktivists but now recognized as an Advanced Persistent Threat (APT) group. This shift in classification stems from their advanced tactics, techniques, and procedures (TTPs) and the non-destructive nature of their operations, which do not involve encryption or data wiping. The latest campaign involved exploiting vulnerabilities in the TrueConf video conferencing server, leading to the deployment of the PhantomCore malware.
The attackers leveraged a combination of two newly identified vulnerabilities, designated as KLCERT-26-057 and KLCERT-26-058, which allowed them to execute arbitrary code with elevated privileges on the compromised systems.
Attack Methodology
The attack unfolds in several stages:
- The attackers gain unauthorized access to the TrueConf server via port 4307/TCP, which is open by default. The targeted versions include 5.3.X through 5.3.9, 5.4.X through 5.4.9, and 5.5.X through 5.5.5.
- After establishing a connection, they invoke a server function to transmit a malicious script, exploiting the vulnerability identified as KLCERT-26-057.
- This script executes within an isolated environment on the TrueConf server, which typically restricts access to operating system functions.
- To escape this isolated environment, the attackers exploit the second vulnerability, KLCERT-26-058, allowing them to execute commands in the context of the operating system.
- With these elevated privileges, they replace the legitimate file
…publicjslocale.phpwith a web shell, enabling remote control of the server.
Malware Deployment and Persistence
The web shell facilitates various malicious activities, including:
- Gathering information about the IT infrastructure.
- Gaining privileged access to the TrueConf database.
- Replacing the original TrueConf Client installer with a compromised version containing the PhantomCore backdoor.
To ensure the malware launches upon system boot, the attackers create a registry key at HKEY_CURRENT_USERSoftwareClassesCLSID{0340F119-A598-4ed9-B0AC-6F6A12D3E755}InprocServer32, pointing to the malicious executable.
Additionally, the attackers deploy a secondary backdoor, dubbed PhantomGraph, which consists of two modules:
SysExcSvc.dll: This module receives commands from the attackers and sends back execution results, utilizing a Microsoft OneDrive account as its command-and-control (C2) server.SysReadSvc.dll: This module executes the commands received fromSysExcSvc.dlland saves the results.
To maintain persistence, the attackers execute a Base64-encoded PowerShell command that installs both modules as Windows services, complicating detection efforts by endpoint detection and response (EDR) tools.
Detection and Recommendations
Kaspersky’s security solutions effectively detect the malicious activities associated with this attack. The malware is identified by various detection names, including:
- Backdoor.PHP.WebShell.abi
- Backdoor.Win64.PhantomCore.dt
- Trojan.Win64.Agent.smgvnc
- Trojan.Win64.Agent.smgvnb
- HEUR:Backdoor.Win64.PhantomCore.gen
Organizations using TrueConf software are strongly advised to update to the latest server versions (5.3.9, 5.4.9, and 5.5.5) as per vendor recommendations. Additionally, it is crucial to verify that client distributions downloaded from the TrueConf server are digitally signed and have not been tampered with, as the malicious versions detected lacked valid signatures.
Even organizations not directly using TrueConf servers should remain vigilant, as employees may connect to compromised servers belonging to business partners during online meetings, potentially downloading infected installation packages.
For a detailed analysis of the attack mechanism and exploited vulnerabilities, refer to the comprehensive report on the Kaspersky ICS CERT website.
Readers can also explore current and upcoming editions through the Cyber Warriors Middle East magazine section.
