Head Mare Breaches TrueConf: From SYSTEM Privileges to Trojanized Legitimate Client Updates

1. Basic Information

• Article Title: Hackers breach TrueConf to trojanize client installers with backdoors
• Publisher: BleepingComputer
• Publication Date: August 8, 2026, 10:16 (As noted in the article)
• Original Source: BleepingComputer
• Primary Source: Kaspersky Securelist
• Related Malware: PhantomCore, PhantomGraph, PHP Web Shell
• Threat Actor: Head Mare
• Vulnerabilities: KLCERT-26-057, KLCERT-26-058 (Kaspersky internal identifiers; CVEs not yet published)
• Products: TrueConf Server 5.3.x < 5.3.9, 5.4.x < 5.4.9, 5.5.x < 5.5.5, and older versions
• Patched Versions: 5.3.9, 5.4.9, 5.5.5 (Released on June 18, 2026)
• Severity: Critical

Kaspersky confirmed active attacks in July 2026. This vulnerability chain and threat actor are separate from the previously reported CVE-2026-3502 / Operation True Chaos.

2. Executive Summary

Attackers connect unauthenticated to the default port 4307/TCP, chain script execution and a sandbox escape to gain SYSTEM privileges, turn TrueConf Server into a web shell, and replace organization-distributed client updates with unsigned installers containing PhantomCore. This attack expands from server compromise into the software distribution channel.

3. Attack Flow

Chain A: TrueConf Server Compromise

1. The attacker makes an unauthenticated connection to the default port 4307/TCP of an unpatched TrueConf Server.
2. They use KLCERT-26-057 to run malicious scripts in the server's isolated environment.
3. They use KLCERT-26-058 to escape the isolated environment and move to OS command execution.
4. They gain NT AUTHORITY\\SYSTEM privileges.
5. They replace ...\\public\\js\\locale.php with a PHP web shell.
6. They use the web shell to scout the IT environment and gain privileged access to the TrueConf database.

Chain B: Trojanizing Client Updates

1. They replace the legitimate TrueConf Client installer on the compromised server with an unsigned malicious version.
2. An organization user or a partner participant downloads the installer/update from the server.
3. The user runs the unsigned installer.
4. PhantomCore is installed on the endpoint.
5. They abuse HKCU\\Software\\Classes\\CLSID\\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\\InprocServer32 for persistence.

Chain C: Post-Compromise Activity via PhantomGraph

1. They deploy SysExcSvc.dll and SysReadSvc.dll from the web shell.
2. They register both DLLs as Windows services using Base64-encoded PowerShell.
3. SysExcSvc.dll gets commands from a Microsoft OneDrive account and sends back the results.
4. SysReadSvc.dll runs commands through a temporary batch file.
5. They run hostname, whoami, and other commands, and dump lsass.exe memory using comsvcs.dll.
6. They start an SSH reverse tunnel to secure continued internal access.

4. Attacker Position and Execution Locations

• Initial Position: Internet connection to the TrueConf Server port 4307/TCP.
• Initial Execution Location: TrueConf isolated script execution environment, followed by the Windows OS SYSTEM context.
• Persistence Location: TrueConf web root, Windows service, and CLSID under HKCU.
• C2: PhantomGraph uses a Microsoft OneDrive account to relay commands and results.
• Secondary Victim Device: Windows endpoint that downloaded the installer from the compromised TrueConf Server.
• Internal Spread: Likely via reverse SSH tunnel. The actual scope of lateral movement is unannounced.

5. Visibility for Victims and Administrators

To TrueConf users, it looks like a normal client update provided by their internal or partner meeting server. However, the malicious installer does not have a valid TrueConf digital signature. Administrators can observe unusual PHP/DLL creation by the TrueConf process, replacement of locale.php, deletion of TrueConf event logs, unknown services, CLSID changes, OneDrive traffic, LSASS dumps, and SSH tunnels.

6. Success and Failure Conditions

Success Conditions

• Vulnerable TrueConf Server is reachable on port 4307/TCP.
• Running versions older than 5.3.9, 5.4.9, or 5.5.5.
• Failure to block the two-stage exploit escaping from the isolated environment to the OS.
• Failure to detect changes to the web root, server distributions, and service registrations.
• Users run the unsigned replacement installer.
• OneDrive, PowerShell, and SSH are allowed without context.

Failure Conditions

• Updating to patched versions and restricting 4307/TCP access to necessary sources only.
• Monitoring the integrity of the TrueConf Server web root and distribution installers.
• Enforcing verification of publisher signatures for client installers.
• Blocking script and DLL generation from the TrueConf process.
• Stopping suspicious services, CLSIDs, LSASS access, and reverse SSH using EDR.
• Detecting OneDrive C2 by endpoint identity and process context.

7. What Happens Upon Success

TrueConf Server is fully compromised with SYSTEM privileges, maintaining persistence via a web shell and PhantomGraph. The TrueConf database and environment information are stolen, and PhantomCore is spread to users and partners through the legitimate distribution channel. On the endpoint, credential theft, reconnaissance, tunnel building, and subsequent command execution become possible.

8. Observable Logs

Email

• Head Mare also uses phishing, but email is not required for the initial intrusion of this chain.
• History of downloading a TrueConf installer after receiving a meeting invitation from a partner is valuable for Inference investigations.

Proxy / SWG / DNS

• Unusual process communication to OneDrive from the TrueConf Server or endpoint.
• Connections to known IOC domains/IPs.
• Client installer download URL, hash, and signature status.
• Long-term connections to SSH reverse tunnel destinations.

Endpoint / EDR

• Creation and replacement of ...\\public\\js\\locale.php by the TrueConf process.
• SysExcSvc.dll, SysReadSvc.dll, graphi-refresh.dat, input_*.txt, output_*.txt.
• %TEMP%\\cmd_cmd_*.bat.
• Service registration from Base64 PowerShell.
• Modification of HKCU CLSID InprocServer32.
• LSASS dump / memory access involving comsvcs.dll.
• Unsigned trueconf_windows_update.exe and abnormal child processes.
• Reverse tunnel via ssh.

Identity / IdP

• Use of TrueConf database service / admin accounts.
• Subsequent use of credentials stolen on the endpoint.
• PhantomGraph API access to OneDrive accounts.
• Inference: Use of new IP and non-interactive access tokens for the same account.

SaaS / Cloud

• Suspicious account, file read/write, and download activity in Microsoft 365 / OneDrive audits.
• Small, periodic command/result exchanges via OneDrive.
• Time correlation between EDR process telemetry and OneDrive audits.

Network

• External connection to TrueConf port 4307/TCP.
• Communication from TrueConf Server to unknown external hosts.
• Outbound SSH connections and long sessions from endpoints.
• Distribution of the same unsigned installer from the server to multiple endpoints.

9. Attack Success Determination

• Contact Only: Scan / connection to 4307/TCP only, no file or process changes.
• User Action: Server compromise is not required. Secondary infection requires running the installer.
• Initial Execution: Attack script runs in the TrueConf isolated environment.
• Malware or Auth Success: SYSTEM commands, locale.php web shell, PhantomCore / PhantomGraph services confirmed.
• Information Theft / Session Compromise: LSASS dump, results sent back to OneDrive, TrueConf database read confirmed.
• Subsequent Compromise Confirmation: Multiple endpoints run unsigned installers, credential reuse, internal commands confirmed via SSH tunnel.

10. Investigation Playbook

Trigger

• Vulnerable TrueConf and 4307/TCP exposed to the public.
• PHP/DLL creation by TrueConf process.
• Unsigned TrueConf installer.
• PhantomGraph files/services, LSASS dumps, reverse SSH.

Initial Checks

1. Determine TrueConf version, patch application time, and public exposure scope of 4307/TCP.
2. Preserve web root, distribution installers, TrueConf database, and event logs.
3. Compare locale.php and client installers with legitimate hashes/signatures.
4. Build a timeline of the initial 4307 connection, file replacement, and installer distribution/execution times.

Endpoint / Server

• TrueConf process tree, PowerShell, services, CLSIDs, PHP web shell.
• SysExcSvc.dll / SysReadSvc.dll and temporary batch files.
• LSASS access, dump files, SSH processes and destinations.
• Identify all endpoints that downloaded and ran the installer from the compromised server.

Authentication / Cloud

• Rotate TrueConf database / service account credentials.
• Revoke domain/local credentials that were accessible after the LSASS dump.
• Identify PhantomGraph command/result objects and accounts via OneDrive audits.
• Review logins for compromised endpoints retrospectively from the time of server compromise.

Subsequent Actions

• Cross-investigate reverse tunnel destinations, internal scans, RDP, SMB, WinRM, etc.
• Hunt for the same hash, service, CLSID, and OneDrive IOCs across all endpoints.
• Check signatures and hashes of installers obtained from partner TrueConf servers.

Containment

• Isolate the server from the network and restrict port 4307/TCP.
• Update to the patched version. Prioritize server rebuilding if compromise is confirmed.
• Remove web shells, PhantomCore / PhantomGraph, services, and CLSIDs after preserving evidence.
• Rotate all related credentials and tokens, and block C2 / SSH destinations.
• Revert to legitimate signed installers and notify users and partners of the malicious distribution period.

Decision Categories

• Scanning Only
• TrueConf Exploit Attempted
• Sandbox Escape / SYSTEM Confirmed
• Server Persistence Confirmed
• Trojanized Installer Distributed
• Endpoint Backdoor Confirmed
• Credential Theft / Tunnel Confirmed
• Lateral Movement Confirmed

11. Defense and Detection Ideas

Single Event

• External connection to 4307/TCP.
• TrueConf process modifies locale.php, DLLs, or installers.
• Execution of unsigned TrueConf installer.
• LSASS dump using comsvcs.dll.
• Outbound SSH from TrueConf Server / client.

Timeline Correlation

4307/TCP connection → TrueConf script execution → SYSTEM command → locale.php replacement → installer replacement → endpoint execution → CLSID/service persistence → LSASS dump → OneDrive C2 / SSH tunnel

Threat Hunting Perspectives

• Review 4307 logs retrospectively from before the patch release date of June 18, 2026.
• Time-series changes of TrueConf distribution installer hashes and list of executing endpoints.
• Cross-search for SysExcSvc / SysReadSvc, CLSIDs, and batch patterns.
• Extract OneDrive access by processes other than browsers or sync clients.

Log Gaps

• 4307/TCP connection sources and payloads.
• TrueConf application / event logs.
• File integrity of web roots and distributed files.
• Process command lines, service / registry telemetry.
• OneDrive audits, LSASS access, east-west / egress SSH.

Priority Actions

1. Update TrueConf Server to 5.3.9 / 5.4.9 / 5.5.5 or higher.
2. Restrict port 4307/TCP and re-evaluate direct internet exposure.
3. Enforce installer signatures and monitor integrity of distributed files and web roots.
4. Investigate all endpoints that downloaded installers since the server compromise time.
5. Correlate detection for OneDrive C2, LSASS dumps, and reverse SSH.

12. Facts / Inference / Hypothesis

Facts

• Head Mare chained KLCERT-26-057 and KLCERT-26-058 to gain SYSTEM privileges.
• The locale.php web shell accessed the TrueConf database and replaced client installers with unsigned versions containing PhantomCore.
• PhantomGraph consists of two DLLs, uses OneDrive for C2, and persists as a Windows service.
• LSASS memory dumps, hostname, whoami, and an SSH reverse tunnel were observed.
• The attack was confirmed in July 2026, and patched versions had been released on June 18.

Inference

• Because users trust files from internal distribution servers, standard download reputation alone cannot easily prevent secondary infections.
• Linking server logs, distribution installer hashes, and endpoint execution makes it possible to precisely determine the scope of damage from server compromise to secondary infection.
• Detecting unusual processes, accounts, and object patterns is more realistic than blocking OneDrive domains entirely.

Hypothesis

• Stolen credentials and SSH tunnels may have been used for lateral movement (such as RDP or SMB) not mentioned in public documents.
• A partner's compromised TrueConf Server could become a watering-hole style secondary infection vector for external organizations.

13. MITRE ATT&CK Mapping

High Confidence

• T1190 Exploit Public-Facing Application
• T1505.003 Server Software Component: Web Shell
• T1195.002 Compromise Software Supply Chain
• T1204.002 User Execution: Malicious File
• T1546.015 Event Triggered Execution: Component Object Model Hijacking
• T1543.003 Create or Modify System Process: Windows Service
• T1059.001 Command and Scripting Interpreter: PowerShell
• T1059.003 Command and Scripting Interpreter: Windows Command Shell
• T1003.001 OS Credential Dumping: LSASS Memory
• T1102.002 Web Service: Bidirectional Communication
• T1572 Protocol Tunneling
• T1082 System Information Discovery
• T1033 System Owner/User Discovery

Medium Confidence

• T1105 Ingress Tool Transfer: Path where backdoors were deployed from the web shell.
• T1021 Remote Services: Internal remote service usage after tunneling is unconfirmed.
• T1070.001 Clear Windows Event Logs: Deletion of TrueConf event logs is based on primary source detection notes, but the full scope of the actor is unannounced.

14. Unknowns / Additional Investigation

• CVE numbers and technical root causes for KLCERT-26-057 / 058.
• Actual exploit start date, number of victim organizations, and all attacker IOCs.
• Full command set of PhantomCore and exfiltration methods.
• Specific C2 patterns for OneDrive accounts / objects.
• Destinations of credentials stolen via LSASS and success/failure of lateral movement.
• Malicious installer distribution period and total endpoint count including affected partners.

15. Impact on SOCs and General Enterprises

Even if TrueConf adoption is limited, connecting to overseas branch or partner meeting servers to download an installer can lead to secondary infections. Security Operations Centers (SOCs) should not determine target presence based solely on their own asset inventory; they need to check proxy and EDR logs for TrueConf installer download and execution history. For similar products where servers distribute client updates—such as on-premises conferencing products or RMM tools—signature verification and distribution integrity checks must be applied broadly.

16. Summary

For SOCs

• Track 4307 connections, web shells, installer replacements, and endpoint executions on a single timeline.
• Cross-hunt for PhantomGraph services, CLSIDs, LSASS dumps, OneDrive C2, and SSH tunnels.
• Include all endpoints that downloaded the malicious installer in the scope of damage, rather than stopping at server compromise confirmation.

For Administrators

• Update TrueConf Server to patched versions and restrict port 4307/TCP to necessary connection sources.
• Monitor the integrity of web roots and distribution installers, and enforce valid publisher signatures.
• Rebuild servers and rotate all related credentials and tokens if compromise is suspected.

For Users

• Do not run unsigned TrueConf installers, even if they come from internal or partner meeting servers.
• If you installed or updated TrueConf clients after June 18, 2026, follow the administrator's investigation guidance.