12 minhigh
The APT group Head Mare exploits vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph malware to video conferencing participants
Head Mare APT group exploited a chain of two vulnerabilities (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf Server instances to achieve unauthenticated remote code execution as SYSTEM via port 4307/TCP. Attackers deployed a web shell by replacing locale.php, then trojanized the TrueConf Client installer to deliver PhantomCore and PhantomGraph backdoors to meeting participants. PhantomGraph uses Microsoft OneDrive for C2 and is split into two DLLs to evade EDR. The vulnerabilities were patched in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5 released on June 18, 2026.
Sens:■ Immediate
Showing defanged values
- filenameC:\Windows\System32\inetsrv\graphi-refresh.datPhantomGraph data file used for C2 communication staging
- filenameC:\Windows\System32\inetsrv\share\input_*.txtInput command files used by PhantomGraph for command ingestion
- filenameC:\Windows\System32\inetsrv\share\output_*.txtOutput result files used by PhantomGraph for command execution results
- filenameC:\Windows\System32\inetsrv\SysExcSvc.dllPhantomGraph C2 module dropped to IIS native module directory
- filenameC:\Windows\System32\inetsrv\SysReadSvc.dllPhantomGraph executor module dropped to IIS native module directory
- filename/etc/systemd/system/omicluster.serviceSystemd service file for Linux backdoor persistence on TrueConf servers
- filename/etc/systemd/system/schedul2-bin.serviceSystemd service file for Linux backdoor persistence on TrueConf servers
- filename%LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dllPhantomCore DLL dropped alongside legitimate TrueConf Client using DLL sideloading naming convention
- filename/omi/bin/omiclusterLinux backdoor binary disguised as OMI cluster component
- filename/opt/acronis/bin/schedul2-binLinux backdoor binary disguised as Acronis scheduler component
- filename%TEMP%\cmd_cmd_*.batBatch files created by PhantomGraph SysReadSvc module for command execution
- filename/usr/lib64/libzvbi-tchain.so.2Linux rootkit shared library installed on TrueConf servers
- filename/var/tmp/cx2Linux backdoor component dropped to temporary directory
- ip194[.]87[.]239[.]71IP used for SSH reverse tunnel to maintain persistent access to compromised servers
- ip194[.]87[.]93[.]153IP used for SSH reverse tunnel to maintain persistent access to compromised servers
- ip31[.]59[.]102[.]61Attacker-controlled IP associated with the campaign
- ip38[.]244[.]205[.]244Attacker-controlled IP used for C2 communication
- ip81[.]177[.]32[.]12Attacker-controlled IP used for C2 communication
- md50e4541c3153ec5ed01497f19cf4f63d0PhantomGraph SysExcSvc.dll variant
- md50e79996d9483d1e44fea32b0a48c2c19PhantomCore DLL disguised as doc.txt
- md5129462164a7d52e9ea8560b60f0412c5PhantomCore DLL disguised as doc.txt
- md512d4e8f5295f2ef7e0f9bfc0f4830939PhantomGraph SysExcSvc.dll variant
- md52bb75c20e778eb5c416965bd4d4259b1Trojanized TrueConf Client installer (trueconf_windows_client_x64_[redacted].exe)
- md543f435c3c437bc879a2d7d4634f43494ELF backdoor with GitHub C2 for Linux TrueConf servers
- md5489f43be558b2679284ceabed7adc4f3MD5 hash of SysExcSvc.dll, the PhantomGraph C2 module that receives commands from attackers via Microsoft OneDrive
- md54d27b4eb1c5dbb3d8160f29b8119523eMD5 hash of locale.php web shell that replaces the legitimate TrueConf file for remote control of compromised server
- md5748c9f8cb1065000616204935f96207fMD5 hash of trojanized trueconf_windows_update.exe installer containing PhantomCore backdoor, distributed from compromised TrueConf servers
- md57f267006cac10f341c356b62fe493527PhantomGraph SysExcSvc.dll variant
- md58fcc3e4ccbf1725d9989fb464abf3561PhantomCore DLL disguised as usocacheddata.txt
- md5aee9642b45b099cb7f3053b9b680b425Rootkit installed on TrueConf Linux servers, hooks PostgreSQL functions
- md5b348642146ea34771e5785c5857950f5PhantomCore DLL component
- md5b3a6fee3307f1c26841fd5c603e2b013PhantomCore DLL disguised as usocacheddata.txt
- md5c3a2abe8756910f42582b04a44ea3514ELF backdoor component for Linux TrueConf servers
- md5c5a460e4e68a088f6e51b2c6474642ecMD5 hash of PhantomCore DLL backdoor delivered through trojanized TrueConf Client installer
- md5c915cb6c2aeb863ee8479238e1644217PhantomCore DLL disguised as doc.txt
- md5dd1fd2b459b97b7d59375cb8383cd19aMD5 hash of SysReadSvc.dll, the PhantomGraph executor module that reads and executes commands passed by SysExcSvc.dll
- md5ec0bf4a2186a88874e9f26f07cfeb532PhantomCore DLL disguised as usocacheddata.txt
- md5ee2861d5965e8730708cd1da8a93fa4cPhantomGraph SysExcSvc.dll variant
- registry_keyHKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32Registry key created for PhantomCore persistence; value points to the malicious DLL path for automatic execution after system boot
Detection / Hunteropenrouter
What Happened
A hacking group called Head Mare found security flaws in TrueConf video conferencing software and used them to break into company servers without needing a password. Once inside, they replaced the legitimate TrueConf meeting app with a malicious version that installs hidden backdoor programs. Anyone who joined a meeting on a compromised server and downloaded the app could be infected. The backdoor software uses Microsoft OneDrive to receive commands, making it harder to detect. The software maker released fixes in June 2026, but any organization that has not updated is still at risk. Organizations should update their TrueConf Server immediately and verify that any TrueConf Client software has a valid digital signature from the manufacturer.
Key Takeaways
- Head Mare APT group exploited two zero-day vulnerabilities (KLCERT-26-057, KLCERT-26-058) in TrueConf Server to achieve unauthenticated remote code execution as NT AUTHORITY\SYSTEM via port 4307/TCP
- Attackers replaced legitimate TrueConf Client installers hosted on compromised servers with trojanized versions containing PhantomCore backdoor, creating a supply-chain risk for all meeting participants
- PhantomGraph backdoor uses Microsoft OneDrive (Microsoft Graph API) for C2 communication, split into two DLLs (SysExcSvc.dll and SysReadSvc.dll) to evade EDR detection
- Patches were released on June 18, 2026 in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5; organizations running earlier versions remain vulnerable
- Attackers performed credential dumping of lsass.exe and established SSH reverse tunnels for persistent access
Affected Systems
- TrueConf Server versions 5.3.X prior to 5.3.9
- TrueConf Server versions 5.4.X prior to 5.4.9
- TrueConf Server versions 5.5.X prior to 5.5.5
- TrueConf Server versions earlier than 5.3.X
- TrueConf Client users downloading installers from compromised servers
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attackers connect to TrueConf Server on port 4307/TCP without authentication and exploit KLCERT-26-057 to inject a script into the server's isolated execution environment
- Exploitation: Attackers exploit KLCERT-26-058 to escape the isolated environment and execute arbitrary code as NT AUTHORITY\SYSTEM
- Persistence: Attackers replace locale.php with a web shell for remote management and create a registry key under HKCU CLSID for PhantomCore persistence
- Delivery: Attackers trojanize the TrueConf Client installer on the server to deliver PhantomCore backdoor to meeting participants who download the client
- Command and Control: PhantomGraph backdoor uses Microsoft OneDrive via Microsoft Graph API for C2, split into SysExcSvc.dll and SysReadSvc.dll to evade EDR
- Credential Access and Lateral Movement: Attackers dump lsass.exe memory and establish SSH reverse tunnels for persistent access
Detection Availability
- YARA Rules: Yes
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: Kaspersky ICS CERT YARA rules, Kaspersky KEDR Expert rules, Kaspersky MDR detection logic, Kaspersky KUMA SIEM rules
The article provides seven YARA rules for detecting PhantomCore, PhantomGraph, the web shell, the trojanized installer, a Linux rootkit, and a GitHub-based backdoor. Kaspersky KEDR Expert rules include unusual_php_file_creation_from_trueconf_process, unusual_file_creation_from_trueconf, and unsigned_trueconf_installer. KUMA SIEM rules are available in a downloadable package. Detection event criteria reference Windows Security events 4688, 4663, 4657, 4697 and Sysmon events 1, 7, 11, 13.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | The article describes specific EDR detection rules for web shell creation by TrueConf processes, unsigned installer execution, suspicious process chains from TrueConf executables, CLSID registry modifications, lsass.exe memory access, and SSH tunnel creation. Kaspersky KEDR Expert and MDR provide multiple detection rules for this campaign. |
| Network Visibility | Medium | SSH reverse tunnels to attacker IPs (194.87.239.71, 194.87.93.153) are detectable at the network level. PhantomGraph C2 over Microsoft OneDrive uses legitimate Microsoft Graph API endpoints over HTTPS, making it difficult to distinguish from normal OneDrive traffic without endpoint context. |
| Detection Difficulty | Moderate | Web shell deployment and unsigned installer execution are straightforward to detect with process and file monitoring. PhantomGraph C2 over OneDrive requires correlation between endpoint behavior and network traffic to identify. The split-DLL architecture of PhantomGraph is designed to evade single-process EDR detection, requiring cross-process correlation. |
Required Log Sources
- Windows Security Event 4688 (Process Creation)
- Windows Security Event 4663 (Object Access)
- Windows Security Event 4657 (Registry Value Modified)
- Windows Security Event 4697 (Service Installed)
- Sysmon Event 1 (Process Creation)
- Sysmon Event 7 (Image Loaded)
- Sysmon Event 11 (File Creation)
- Sysmon Event 13 (Registry Value Set)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| TrueConf Server processes (tc_webmgr.exe, tc_server.exe) creating PHP files or writing to web-accessible directories may indicate web shell deployment | Sysmon Event 11 (File Creation) filtered on TrueConf Server process names and PHP file extensions | Persistence | Low - TrueConf Server processes do not normally create PHP files in web directories |
| Execution of TrueConf Client installer or update binary without a valid digital signature may indicate a trojanized installer | Sysmon Event 7 (Image Loaded) or EDR signature verification events for trueconf_windows_update.exe and trueconf_windows_client_x64.exe | Execution | Low - legitimate TrueConf installers are signed by the vendor |
| DLL registration under HKCU\Software\Classes\CLSID\ with InprocServer32 subkey may indicate PhantomCore persistence mechanism | Windows Security Event 4657 or Sysmon Event 13 monitoring registry writes to HKCU CLSID paths | Persistence | Medium - some legitimate COM object registrations occur under HKCU, but the specific CLSID GUID can be filtered |
| Creation of Windows services SysExcSvc or SysReadSvc with binary paths pointing to temp directories or IIS native module directories may indicate PhantomGraph installation | Windows Security Event 4697 (Service Installed) filtered on service names and binary path patterns | Persistence | Low - these service names are not associated with legitimate software |
| SSH process execution originating from TrueConf Server service context may indicate reverse tunnel establishment for persistent access | Sysmon Event 1 (Process Creation) with parent process matching TrueConf Server executables and child process matching ssh.exe | Command and Control | Low - TrueConf Server does not normally spawn SSH processes |
Control Gaps
- Network-based detection alone cannot identify PhantomGraph C2 traffic because it uses legitimate Microsoft OneDrive endpoints over HTTPS
- Signature-based antivirus may miss PhantomGraph due to its split-DLL architecture designed to evade single-file analysis
- Organizations that do not monitor TrueConf Server process activity will miss web shell deployment and installer replacement
- Users connecting to external compromised TrueConf servers for meetings may download trojanized clients outside of corporate endpoint controls
Key Behavioral Indicators
- TrueConf Server processes (tc_webmgr.exe, tc_server.exe) creating files in web directories
- Unsigned TrueConf Client installer or update binary execution
- Process chains originating from trueconf_windows_update.exe spawning unexpected child processes
- Registry writes to HKCU\Software\Classes\CLSID{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32
- Creation of Windows services named SysExcSvc or SysReadSvc
- Batch file execution from %TEMP%\cmd_cmd_*.bat by service-hosted DLLs
- lsass.exe memory access or dump creation via comsvcs.dll from non-standard process context
- SSH process creation from TrueConf Server service account context
- File writes to C:\Windows\System32\inetsrv\ by TrueConf Server processes
False Positive Assessment
Low - The described indicators are specific to TrueConf Server infrastructure and use non-standard service names, file paths, and registry keys. The primary false positive risk is from legitimate COM object registrations under HKCU CLSID, which can be reduced by filtering on the specific GUID. SSH tunneling from TrueConf Server processes is anomalous enough to warrant investigation regardless of false positive rate.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider updating TrueConf Server to version 5.3.9, 5.4.9, or 5.5.5 immediately if running an affected version, as patches for both vulnerabilities were released on June 18, 2026.
- Consider hunting for the listed IOCs across endpoint and network telemetry, focusing on the web shell hash, trojanized installer hash, PhantomGraph DLL hashes, and the registry persistence key.
- If your organization uses TrueConf, verify that all TrueConf Client installers downloaded from servers have a valid digital signature from TrueConf. Trojansized installers lack valid signatures.
- If a compromised TrueConf Server is identified, consider isolating the host and investigating for web shell presence at ...\public\js\locale.php, PhantomGraph DLLs in C:\Windows\System32\inetsrv, and the persistence registry key.
Infrastructure Hardening
- Consider restricting network access to TrueConf Server port 4307/TCP to only trusted internal networks or VPN clients, as the exploit requires unauthenticated access to this port.
- Evaluate whether network segmentation can isolate TrueConf Server infrastructure from critical internal network segments.
- Consider monitoring outbound SSH connections from TrueConf Server hosts to detect reverse tunnel establishment.
- If applicable, consider deploying application-layer firewall rules to inspect and block anomalous requests to TrueConf Server administration functions.
User Protection
- Consider deploying EDR rules to detect unsigned TrueConf Client installer execution on endpoints, as users may download trojanized clients from external compromised servers.
- Evaluate whether endpoint controls can detect DLL sideloading patterns in the TrueConf Client directory, specifically files matching api-ms-win-crt-time-l1-1-0-2.dll naming.
- Consider educating users that TrueConf Client software should only be downloaded from the official TrueConf website or a known-trusted internal server.
Security Awareness
- Consider incorporating guidance into existing awareness programs about the risk of downloading meeting client software from external or partner-hosted servers, as these may be compromised.
- If applicable, consider advising employees to verify the digital signature of any TrueConf Client installer before execution.
- Consider raising awareness among IT staff that TrueConf Server requires prompt patching and that port 4307/TCP should not be exposed to the internet.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Ips:
31[.]59[.]102[.]61- Attacker-controlled IP associated with the campaign
- File Hashes:
129462164a7d52e9ea8560b60f0412c5(MD5) - PhantomCore DLL disguised as doc.txtec0bf4a2186a88874e9f26f07cfeb532(MD5) - PhantomCore DLL disguised as usocacheddata.txtb348642146ea34771e5785c5857950f5(MD5) - PhantomCore DLL componentc915cb6c2aeb863ee8479238e1644217(MD5) - PhantomCore DLL disguised as doc.txt0e79996d9483d1e44fea32b0a48c2c19(MD5) - PhantomCore DLL disguised as doc.txt2bb75c20e778eb5c416965bd4d4259b1(MD5) - Trojanized TrueConf Client installer (trueconf_windows_client_x64_[redacted].exe)b3a6fee3307f1c26841fd5c603e2b013(MD5) - PhantomCore DLL disguised as usocacheddata.txt8fcc3e4ccbf1725d9989fb464abf3561(MD5) - PhantomCore DLL disguised as usocacheddata.txt0e4541c3153ec5ed01497f19cf4f63d0(MD5) - PhantomGraph SysExcSvc.dll variant12d4e8f5295f2ef7e0f9bfc0f4830939(MD5) - PhantomGraph SysExcSvc.dll variant7f267006cac10f341c356b62fe493527(MD5) - PhantomGraph SysExcSvc.dll variantee2861d5965e8730708cd1da8a93fa4c(MD5) - PhantomGraph SysExcSvc.dll variantc3a2abe8756910f42582b04a44ea3514(MD5) - ELF backdoor component for Linux TrueConf servers43f435c3c437bc879a2d7d4634f43494(MD5) - ELF backdoor with GitHub C2 for Linux TrueConf serversaee9642b45b099cb7f3053b9b680b425(MD5) - Rootkit installed on TrueConf Linux servers, hooks PostgreSQL functions
- File Paths:
C:\Windows\System32\inetsrv\SysExcSvc.dll- PhantomGraph C2 module dropped to IIS native module directoryC:\Windows\System32\inetsrv\SysReadSvc.dll- PhantomGraph executor module dropped to IIS native module directoryC:\Windows\System32\inetsrv\graphi-refresh.dat- PhantomGraph data file used for C2 communication stagingC:\Windows\System32\inetsrv\share\input_*.txt- Input command files used by PhantomGraph for command ingestionC:\Windows\System32\inetsrv\share\output_*.txt- Output result files used by PhantomGraph for command execution results%TEMP%\cmd_cmd_*.bat- Batch files created by PhantomGraph SysReadSvc module for command execution%LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll- PhantomCore DLL dropped alongside legitimate TrueConf Client using DLL sideloading naming convention/etc/systemd/system/omicluster.service- Systemd service file for Linux backdoor persistence on TrueConf servers/etc/systemd/system/schedul2-bin.service- Systemd service file for Linux backdoor persistence on TrueConf servers/opt/acronis/bin/schedul2-bin- Linux backdoor binary disguised as Acronis scheduler component/omi/bin/omicluster- Linux backdoor binary disguised as OMI cluster component/usr/lib64/libzvbi-tchain.so.2- Linux rootkit shared library installed on TrueConf servers/var/tmp/cx2- Linux backdoor component dropped to temporary directory
- Command Lines:
- Purpose: Install PhantomGraph DLLs as Windows services for persistence | Tools:
powershell.exe| Stage: Persistence - Purpose: Execute batch file containing attacker commands for reconnaissance and credential dumping | Tools:
cmd.exe| Stage: Execution |cmd.exe /c - Purpose: Create SSH reverse tunnel for persistent remote access to compromised server | Tools:
ssh| Stage: Command and Control - Purpose: Dump lsass.exe process memory for credential extraction | Tools:
rundll32.exe,comsvcs.dll| Stage: Credential Access
- Purpose: Install PhantomGraph DLLs as Windows services for persistence | Tools:
- Other:
SysExcSvc- Windows service name registered by PhantomGraph for C2 module persistenceSysReadSvc- Windows service name registered by PhantomGraph for executor module persistence
Related
- Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants·5
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-72529, CVE-2026-72530)·1
- wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution·1
Stay currentSubscribe via RSS