How Head Mare got in
Head Mare, a hacktivist group that has been actively targeting Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development sectors, found a straightforward path into TrueConf video conferencing servers: TCP port 4307, which the software leaves open by default without requiring authentication. Using two vulnerabilities tracked by Kaspersky's incident response team as KLCERT-26-057 and KLCERT-26-058, the group executed malicious scripts against exposed servers and escalated privileges all the way to NT AUTHORITY\SYSTEM, the highest level of access on a Windows host.
That level of access on the server itself was the real prize. Rather than simply exfiltrating data from the compromised host, Head Mare installed a persistent web shell inside the server's locale.php file, giving them ongoing access even after the initial entry point might eventually be noticed and closed off. From that position, they were able to modify the server's own software distribution mechanism, the exact channel every connected client trusts by design to deliver legitimate updates.
The trojanized installer and two backdoors
With persistent access to the TrueConf server, Head Mare replaced the legitimate client installer with a trojanized version bundled with a backdoor Kaspersky named PhantomCore. Because the installer was served from the organization's own trusted TrueConf server, users who downloaded what they believed was a routine client update or reinstall received the backdoor without any indication that anything was wrong, since the delivery channel itself was the compromised asset, not an external phishing link or fake website.
A second, separate backdoor called PhantomGraph was also deployed as part of the intrusion, using a notably unusual command-and-control channel: Microsoft OneDrive accounts. That design choice lets the backdoor's traffic blend into normal, expected enterprise cloud storage activity rather than standing out as suspicious network traffic to a novel or flagged domain. PhantomGraph, built from two DLL components, is capable of dumping credentials from LSASS memory and executing reconnaissance commands against the compromised environment.
Why the blast radius extends past TrueConf customers
The detail that should concern security teams furthest outside TrueConf's direct customer base is Kaspersky's specific warning: 'Even if your organization does not use the TrueConf server, employees who connect to a compromised counterparty's TrueConf server can download infected installation packages.' In other words, using a vendor's video conferencing product internally is not the only exposure path. Simply joining a video call hosted on a compromised third-party TrueConf server and accepting a prompted client update is enough to inherit the same backdoors.
That transitive exposure model, where your risk depends on your business partners' patch hygiene rather than only your own, is exactly the pattern that makes third-party and fourth-party risk assessment genuinely difficult in practice. A vendor risk questionnaire sent to your direct TrueConf-using counterparties will not surface this risk if those counterparties themselves do not yet know their own server has been compromised, which is the normal state of affairs during an active, undiscovered intrusion like this one.
The pattern: compromise the update pipe, not the endpoint
This intrusion follows a well-established and highly effective supply chain pattern: rather than attacking thousands of individual endpoints directly, compromise the single trusted distribution point that all of those endpoints already check for updates, and let the built-in trust relationship do the distribution work for the attacker automatically. It is the same fundamental logic behind the SolarWinds and 3CX compromises that shook enterprise security teams in prior years, applied here to a regional collaboration software vendor rather than an IT management or telephony platform, with the same multiplying effect on every downstream customer who trusts the channel.
Collaboration and conferencing software is a particularly attractive target for this pattern because it typically runs with broad system permissions, often has direct network access to internal systems for screen sharing and file transfer functionality, and generates enough routine background update traffic that a malicious update rarely draws scrutiny from users or from network monitoring tools tuned to flag genuinely anomalous connections rather than expected, routine vendor traffic that IT teams have long since learned to treat as background noise.
Hacktivism with a professional toolkit
Head Mare's profile as a hacktivist group rather than a financially motivated criminal syndicate or a formal nation-state unit is worth noting, because the tradecraft on display here does not match older assumptions about what hacktivist groups are capable of. Two custom backdoors, a purpose-built command-and-control channel disguised inside legitimate cloud storage traffic, privilege escalation to SYSTEM level, and a working supply chain compromise of a vendor's own update pipeline is a level of operational sophistication that would have been described as nation-state grade a few years ago.
That blurring matters for threat modeling because it means the old shortcut of deprioritizing hacktivist activity as noisy, low-skill, or purely disruptive no longer holds reliably across the board. Whatever Head Mare's stated motivations, the technical capability demonstrated in this campaign, reaching SYSTEM privileges, deploying dual backdoors, and pulling off a genuine supply chain compromise, is functionally indistinguishable from the tradecraft security teams typically reserve their highest level of concern for.
What to check in your own environment
If your organization runs TrueConf or any similar on-premises collaboration platform, confirm the patch status against KLCERT-26-057 and KLCERT-26-058 immediately, verify that administrative ports are not exposed without authentication by default on your deployment, and audit recent client installer updates against known-good file hashes rather than simply assuming the update channel itself is trustworthy just because it originates from the vendor's own server infrastructure and carries the vendor's normal branding and signing.
More broadly, this incident is a reason to extend software supply chain scrutiny beyond the code dependencies most security teams already track through SBOM and software composition analysis tooling, and into the update delivery infrastructure of every on-premises enterprise software product your organization runs, including the collaboration tools that rarely make it onto a vulnerability management roadmap. A dependency scanner will not catch a compromised update server, because from the scanner's point of view, the trojanized installer looks exactly like a legitimate one signed by a vendor you already trust and have never had reason to question before now.
