Researchers at Kaspersky discovered that the Head Mare group exploited two vulnerabilities in TrueConf Server versions prior to 5.3.9, 5.4.9, and 5.5.5 to execute arbitrary code with SYSTEM privileges. The attackers replaced the legitimate client installer with a trojanized version containing the PhantomCore backdoor, which is distributed to users as an update. Additionally, the PhantomGraph backdoor, consisting of two DLLs, accepts commands via Microsoft OneDrive to perform reconnaissance and credential dumping. The vulnerabilities exploited include KLCERT-26-057 (code execution in an isolated environment) and KLCERT-26-058 (sandbox escape). The attacks have been observed targeting Russian organizations across various sectors. TrueConf released official patches on June 18, 2026, to fix these vulnerabilities.

Successful exploitation allows attackers to execute arbitrary code with SYSTEM privileges on TrueConf servers, gain persistent remote access via a web shell, replace legitimate client installers with trojanized versions containing backdoors, and exfiltrate sensitive information including credentials. This compromises the confidentiality and integrity of affected organizations' communications and systems. The trojanized client installers can infect users connecting to compromised TrueConf servers, even if their own organization does not use TrueConf servers internally.

TrueConf released official patches addressing these vulnerabilities in versions 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026. Organizations should promptly update to these fixed versions to remediate the vulnerabilities. Until patched, restrict access to TCP port 4307 and monitor for unauthorized modifications to TrueConf server files. Users should verify the digital signature of client installers and avoid connecting to untrusted TrueConf servers. No vendor advisory states that no action is required or that the issue is already mitigated without patching.