MalwarePublished 8 Aug 2026

Hackers breach TrueConf to trojanize client installers with backdoors

Source Bleeping Computer

Description

The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors. [...]

Impact

Successful exploitation allows attackers to execute arbitrary code with SYSTEM privileges on TrueConf servers, gain persistent remote access via a web shell, replace legitimate client installers with trojanized versions containing backdoors, and exfiltrate sensitive information including credentials. This compromises the confidentiality and integrity of affected organizations' communications and systems. The trojanized client installers can infect users connecting to compromised TrueConf servers, even if their own organization does not use TrueConf servers internally.

Defensive guidance

TrueConf released official patches addressing these vulnerabilities in versions 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026. Organizations should promptly update to these fixed versions to remediate the vulnerabilities. Until patched, restrict access to TCP port 4307 and monitor for unauthorized modifications to TrueConf server files. Users should verify the digital signature of client installers and avoid connecting to untrusted TrueConf servers. No vendor advisory states that no action is required or that the issue is already mitigated without patching.

References

bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 Aug 2026, 14:26 UTC

References

Community reviews