Security researchers from Kaspersky have identified a significant cyber threat targeting TrueConf video conferencing software. The investigation revealed that software installers, believed to be legitimate by users, were bundled with PhantomCore malware. This malicious activity is linked to the Head Mare APT group, exploiting vulnerabilities in Russian organizations.
TrueConf Servers Leveraged for Malware Distribution
The attackers manipulated TrueConf servers to distribute compromised software directly, making downloads appear trustworthy to unsuspecting employees. By exploiting two specific vulnerabilities, labeled KLCERT-26-057 and KLCERT-26-058, the hackers managed to execute harmful code on these servers.
The first vulnerability allowed unauthorized access through port 4307/TCP, enabling attackers to run illicit scripts. The second flaw provided the means to escape an isolated environment, granting attackers system-level privileges. This access was used to replace genuine server files with malicious web shells, facilitating further infiltration into the victim’s IT infrastructure.
Impact on Windows and Linux Systems
On Windows machines, the attackers installed backdoor services named SysExcSvc and SysReadSvc, using Microsoft OneDrive for command and control communication. Linux systems were similarly compromised through a backdoor that intercepted TrueConf network traffic, utilizing GitHub for remote operations. Users joining video calls on affected servers received prompts to download a new client application, which secretly installed malware alongside the legitimate software.
A registry key was created to ensure the malware’s persistence through system reboots. Kaspersky warns that organizations using TrueConf servers, as well as those participating in meetings on third-party compromised servers, are at risk.
Mitigation and Response Strategies
TrueConf has addressed these vulnerabilities in server versions 5.3.9, 5.4.9, and 5.5.5, released on June 18, 2026. Kaspersky’s analysis showed that all server versions released since 2022 were vulnerable before this patch. Administrators are urged to update their systems promptly and monitor for signs of compromise using indicators provided by Kaspersky.
Security teams should conduct thorough antivirus scans and reset passwords for potentially exposed accounts. If indicators of compromise are detected, contacting Kaspersky’s ICS CERT team is recommended for further investigation and support.
This incident underscores the risks associated with software supply chains, where trusted applications can become vectors for extensive system breaches. A detailed analysis and further findings are anticipated in an upcoming Kaspersky Threat Intelligence report.
