True Conf Server Flaws Exploited to Replace Client Installers with Phantom Core

Summary: Kaspersky detected in July 2026 that the actor Head Mare exploited a vulnerability chain in unpatched TrueConf videoconferencing servers, tracked as KLCERT-26-057 and KLCERT-26-058, to gain elevated code execution and replace original TrueConf client installers with poisoned versions delivering the PhantomCore backdoor and RAT. The web shell used in the chain also collected infrastructure data, accessed the TrueConf database, and deployed a second backdoor, PhantomGraph, whose SysExcSvc.dll and SysReadSvc.dll modules were installed as Windows services via a Base64-encoded PowerShell command and used Microsoft OneDrive as command-and-control.
What you should know: The vendor patched these flaws on June 18, 2026, yet CISA added CVE-2026-72529 and CVE-2026-72530 to its KEV catalog on August 20, 2026, with FCEB remediation deadlines of August 23 and September 3 - meaning any TrueConf server still on 5.3.x through 5.3.9, 5.4.x through 5.4.9, or 5.5.x through 5.5.5 is a candidate for an installer swap that turns your own users' updates into the delivery mechanism.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-3502
Related: CVE-2026-3502: True Conf Client Download of Code Without Integrity Check Vulnerability Known Exploited Vulnerabilities · Apr 02, 2026
⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026