DEV Community

Anoymask
Anoymask

Posted on

TrueConf Server Exploitation: PhantomCore Delivered via CVE-2026-72529 / 72530

#security #threatintel

1. Basic Information

  • Article Title: Head Mare APT Group exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware to conference participants
  • Publisher: Kaspersky ICS CERT
  • Publication Date: 2026-08-12
  • Update Date: 2026-08-21
  • Severity: critical
  • Source: Kaspersky ICS CERT
  • Related Sources: CISA Known Exploited Vulnerabilities Catalog, CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities
  • Related Entities:
    • malware: PhantomCore
    • groups: Head Mare
    • cves: CVE-2026-72529, CVE-2026-72530
    • products: TrueConf Server, TrueConf Client, Windows, Linux
  • Reason for Re-evaluation: The assignment of CVE-2026-72529 and CVE-2026-72530, along with their addition to the CISA KEV catalog, significantly increased the priority as actively exploited vulnerabilities.

2. Summary in One Sentence

Attackers compromise unpatched TrueConf Servers using two vulnerabilities, replace official client installers with PhantomCore-infected versions, and spread the infection to conference participant devices.

3. Attack Flow

1. From Windows TrueConf Server to Participant Devices

  1. The attacker reaches port 4307/TCP and uses CVE-2026-72529 to execute scripts inside an isolated environment.
  2. The attacker uses CVE-2026-72530 to escape the isolated environment and execute code on the host.
  3. The attacker replaces locale.php with a web shell to investigate infrastructure and gain privileged access to the TrueConf database.
  4. The attacker replaces the official Windows x64 client installer with one containing PhantomCore.
  5. Conference participants run the update, which installs both the official client and the PhantomCore DLL.

2. Linux / Unix Servers

  1. Attackers compromise the TrueConf Server using the two vulnerabilities.
  2. They hook TrueConf network functions to hide files and introduce a backdoor that receives commands via the TrueConf protocol.
  3. Another backdoor uses GitHub as a C2 server.

4. Attacker Position and Execution Locations

  • Network paths with access to port 4307/TCP on the TrueConf Server
  • Web shells and databases on compromised TrueConf Servers
  • Tampered official client distribution paths
  • TrueConf Client directories on infected participant devices

5. Visibility for Victims and Administrators

Victims

  • The update looks like a normal TrueConf client update.
  • The official client runs at the same time, making the infection hard to notice.

Administrators / SOCs

  • Modifications to locale.php, deleted event logs, and file hash changes in client installers appear.
  • Suspicious services (SysExcSvc / SysReadSvc) or suspicious DLLs under the TrueConf Client path are observed.
  • On Linux, suspicious network traffic to the TrueConf protocol or GitHub occurs.

6. Success and Failure Conditions

Success Conditions

  • Reachable via port 4307/TCP on a vulnerable TrueConf Server.
  • Successful chaining of CVE-2026-72529 and CVE-2026-72530.
  • Attackers can modify the distributed installer.
  • Participants execute the tampered update.

Failure Conditions

  • Update to versions 5.3.9, 5.4.9, 5.5.5, or later.
  • Restrict port 4307/TCP to trusted networks only.
  • Monitor integrity of the web root and client distribution files.
  • Detect and block known IOCs, services, DLLs, and GitHub C2 traffic.

7. What Happens on Success

  • Arbitrary code execution on the TrueConf Server host
  • Persistent access and database compromise via web shell
  • Distribution of PhantomCore to participant devices through official update paths
  • Windows/Linux backdoors and C2 communication
  • Expansion of the breach to participant organizations

8. Observable Logs

Email

  • Email vectors are not required.

Proxy / SWG / DNS

  • Periodic suspicious communication from the Linux server to GitHub
  • Communication from participant devices to the PhantomCore C2

Endpoint / EDR

  • Tampering of TrueConf Server public/js/locale.php
  • Hash changes in ClientInstFiles/trueconf_windows_client_x64.exe
  • %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll
  • SysExcSvc, SysReadSvc

Identity / IdP

  • Abnormal privileged access to the TrueConf database
  • Credentials used after the compromise

SaaS / Cloud

  • Linux backdoor using GitHub as a C2

Network

  • Suspicious requests to port 4307/TCP
  • Abnormal command traffic within the TrueConf protocol

9. Attack Success Determination

  • Attack Attempt Observed (Success Unconfirmed): Vulnerability scanning or crafted requests to port 4307/TCP only, without file tampering.
  • Initial Execution Confirmed: Evidence of script execution inside the isolated environment via CVE-2026-72529.
  • Malware Execution or Authentication Success Confirmed: Host code execution, web shell, and backdoor confirmed after CVE-2026-72530.
  • Subsequent Compromise Confirmed: Tampered client installer and PhantomCore execution confirmed on participant devices.

10. Investigation Playbook

Trigger

  • External exposure of vulnerable TrueConf servers
  • KEV vulnerability alerts
  • Changes to locale.php or distribution installers

Initial Check

  • Check TrueConf version and exposure range of port 4307/TCP
  • Cross-check CISA/Kaspersky IOCs and file hashes

Endpoints

  • Preserve web root, ClientInstFiles, services, and DLLs
  • Investigate Linux hooks, hidden files, and GitHub traffic

Authentication / Cloud

  • Check TrueConf database and admin account activity
  • Rotate affected credentials

Subsequent Actions

  • Identify all participant devices that downloaded the tampered installer
  • Investigate PhantomCore and lateral movement

Containment

  • Isolate server, update software, stop tampered distribution
  • Isolate participant devices, change credentials, rebuild systems if necessary

Determination Categories

  • Attack attempt
  • Isolated environment execution
  • Host escape
  • Server compromise
  • Participant device compromise

11. Defense and Detection Ideas

Single Events

  • locale.php rewrite
  • Signature or hash mismatch on TrueConf distribution EXE
  • Creation of SysExcSvc / SysReadSvc

Time-Series Correlation

  • Port 4307/TCP crafted request -> Web shell -> Database access -> Installer tampering -> Participant device infection

Hunting Perspectives

  • TrueConf Server and Client paths, services, and DLLs
  • Periodic communication from TrueConf servers to GitHub
  • Suspicious DLLs generated immediately after updates

Log Gaps

  • TrueConf custom protocol auditing
  • List of devices that downloaded distribution installers
  • File integrity monitoring of the web root

Priority Countermeasures

  • Immediate updating
  • Restriction of port 4307/TCP
  • Distribution signature and hash verification
  • Cross-device investigation of participants if servers are compromised

12. Facts / Inference / Hypothesis

Facts

  • Kaspersky investigated a case where Head Mare chained two vulnerabilities to place a web shell on a TrueConf Server.
  • Attackers tampered with the official client installer to distribute PhantomCore to conference participant devices.
  • CISA added CVE-2026-72529 and CVE-2026-72530 to the KEV catalog.
  • Fixed versions are TrueConf Server 5.3.9, 5.4.9, and 5.5.5.

Inference

  • TrueConf Server compromise is not limited to a single server; it spreads to multiple organizations through trusted client update paths.

Hypothesis

  • Attackers may be selecting organizations belonging to conference participants as their next intrusion targets.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: high)
  • T1505.003 Server Software Component: Web Shell (Confidence: high)
  • T1195.002 Compromise Software Supply Chain (Confidence: high)
  • T1543.003 Create or Modify System Process: Windows Service (Confidence: high)
  • T1102.003 Web Service: One-Way Communication (Confidence: medium) — Mapping to GitHub C2.

14. Unknowns and Additional Investigation

  • Number of victim organizations and participant devices
  • Method used to discover the initial TrueConf Server
  • Scope of subsequent data theft by PhantomCore

15. Impact on SOCs and Global Enterprises

Organizations using on-premises conferencing infrastructure must not only update their servers but also verify the integrity of clients distributed in the past. Organizations utilizing this product globally should treat these vulnerabilities as critical KEV items.

16. Target-Specific Summaries

For SOCs

Track not only TrueConf servers but also participant devices that downloaded the tampered installer.

For Administrators

Update to fixed versions, restrict port 4307/TCP, and verify the integrity of the web root and distribution files.

For Users

If warnings or suspicious behavior occur after a TrueConf update, do not run it again and contact your administrator.

Top comments (0)