PhantomCore and PhantomGraph backdoors delivered via an unpatched TrueConf server

The Head Mare APT group exploited a chain of vulnerabilities in TrueConf video conferencing servers to deploy PhantomCore and PhantomGraph backdoors. Attackers connected to unpatched TrueConf servers via port 4307/TCP without authorization, using vulnerabilities KLCERT-26-057 and KLCERT-26-058 to execute arbitrary code with NT AUTHORITY\SYSTEM privileges. They replaced legitimate TrueConf client installers with infected versions containing PhantomCore, and deployed a web shell for persistent access. The PhantomGraph backdoor utilized Microsoft OneDrive as command-and-control infrastructure. Affected TrueConf versions included 5.3.X through 5.3.9, 5.4.X through 5.4.9, and 5.5.X through 5.5.5. Multiple Russian organizations across various industries were targeted, including instrument manufacturing, electronics, transportation, energy, IT, and software development. The vulnerabilities were patched in June 2026.

• Head Mare APT Group exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware to conference participantsMalware2026-08-21
• ARTEX: Agentic AsbestosMalware2026-11-06
• Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC LauncherMalware2026-11-05
• Poisoned Source: APT29 Watering Holes Targets Mobile DevicesMalware2026-11-04
• Swarming Against Citrix 0-Day ExploitationCampaign2026-10-01