What should we do if our company still runs an old version of TrueConf Server?

Update immediately to version 5.3.9, 5.4.9, or 5.5.5, block internet access to port 4307/TCP, and verify the installed client's hash against the official distribution — if the server went unpatched for long, the installer may already be compromised.

How is PhantomGraph different from PhantomCore?

PhantomCore is Head Mare's primary backdoor, while PhantomGraph is a newer tool from the same group that uses Microsoft OneDrive as its command-and-control channel, making it harder to spot with standard network filters.

Will a VPN help if the corporate software installer itself is infected?

No — a VPN doesn't inspect installer contents and won't stop an infected package. But it encrypts the rest of a device's traffic, limiting the damage if the company's internal network is already compromised by attackers.

← All news

September 27, 2026

TrueConf Flaws Let Hackers Swap Client With Backdoor

Emily ParkerContent & SEO Specialist

TrueConf Flaws Let Hackers Swap Client With Backdoor

In short: On September 25, 2026, Positive Technologies added a TrueConf Server vulnerability chain (CVE-2026-72529 and CVE-2026-72530) to its September trending-threats digest — the flaws let an unauthenticated attacker remotely execute code and take full control of a video-conferencing server. According to Kaspersky, the Head Mare threat group has been exploiting these flaws since July 2026: on unpatched TrueConf Server instances, it swaps the official client installer for an infected copy and delivers its own PhantomCore and PhantomGraph backdoors to video-call participants at Russian companies.

What happened

TrueConf Server is a widely used Russian video-conferencing platform, adopted by companies and government bodies as an alternative to foreign services. The vendor closed two critical vulnerabilities back in June 2026 with versions 5.3.9, 5.4.9, and 5.5.5, but according to Kaspersky ICS CERT, a significant share of servers still run older, unpatched versions. On September 25, Positive Technologies flagged this chain again in its monthly trending-vulnerability digest, alongside fresh flaws in JetBrains TeamCity, Microsoft SharePoint Server, Windows AFD.sys, and Zimbra Collaboration Suite.

How the attack works

The chain starts by reaching the TrueConf server over port 4307/TCP, which is open by default and requires no authentication. CVE-2026-72529 lets an attacker invoke an undocumented server function and run an arbitrary script inside an isolated sandbox where potentially dangerous libraries are unavailable. The second flaw, CVE-2026-72530, allows breaking out of that sandbox to execute code at the operating-system level with maximum NT AUTHORITY\SYSTEM privileges. With that access, Head Mare deploys a web shell, maps the victim's IT infrastructure, gains access to the TrueConf database, and quietly replaces the original client installer with an infected copy — delivering the PhantomCore backdoor (and, in newer attacks, PhantomGraph, which uses Microsoft OneDrive as a command channel) to employees who simply update or reinstall their video-calling app.

Who's targeted and why it's dangerous

Kaspersky ICS CERT reports Head Mare targeting Russian companies in instrumentation, electronics, transportation, energy, IT, and software development. The real danger lies in the delivery vector, not just the flaw itself: an employee downloads nothing from a suspicious site and opens no malicious attachment — they simply install their company's own video-conferencing client from their own company's server. The infected installer looks legitimate, and workstation antivirus or UAC often trusts software arriving from an internal server.

How to protect yourself

Update TrueConf Server immediately to version 5.3.9, 5.4.9, or 5.5.5 — the patches close both flaws in the chain.
Restrict internet access to port 4307/TCP — it shouldn't be exposed externally if the server only serves internal staff.
Verify the client installer's hash before updating if the server hasn't been patched recently — compare it against the official distribution on TrueConf's site.
Monitor for unusual network activity from the conferencing server — connections to OneDrive from a server process, or unexpected web shells, are a clear compromise indicator.
Encrypt the channel all the way to the device, not just at the corporate perimeter. LiMP VPN on an employee's phone or laptop won't stop an infected corporate installer, but it protects the rest of their traffic from interception if the internal network is already compromised. See plans for details.

Sources

← All news