Head Mare APT Group exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware to conference participants

The Head Mare advanced persistent threat group exploited two unpatched vulnerabilities in TrueConf video conferencing servers to conduct a supply chain attack. By leveraging these flaws, attackers executed arbitrary code on the servers, replaced legitimate TrueConf client installers with malicious versions containing the PhantomCore backdoor, and deployed web shells for persistent access. When conference participants downloaded the compromised client software, their systems became infected, allowing attackers full control. On Linux servers, the attackers installed additional backdoors that communicated via GitHub as a command and control channel. The affected TrueConf server versions include all releases since 2022 prior to 5.3.9. Official patches addressing these vulnerabilities were released in versions 5.3.9, 5.4.9, and 5.5.5 in June 2026.

Successful exploitation results in full system compromise of conference participants who download the infected TrueConf client installers. Attackers gain persistent remote access via PhantomCore backdoors and web shells, enabling control over affected systems. Linux servers may have additional backdoors communicating through GitHub, increasing attacker persistence and stealth. Organizations using TrueConf servers prior to patched versions or whose employees participate in conferences hosted on compromised servers are at risk.

TrueConf has released official patches in versions 5.3.9, 5.4.9, and 5.5.5 to address the exploited vulnerabilities. Organizations should upgrade their TrueConf servers to one of these patched versions immediately. Participants should obtain TrueConf client software only from trusted, updated sources. There is no indication that the vulnerabilities affect cloud-hosted services. No additional mitigation steps are specified by the vendor advisory.