Head Mare APT trojanizes TrueConf client installers
Kaspersky detected a new Head Mare campaign in July 2026 targeting unpatched TrueConf servers. The group exploits a vulnerability tracked internally as KLCERT-26-057 to replace the legitimate TrueConf Client installer with a malicious version, delivering backdoors to video conference participants.
The attack chain begins when Head Mare connects to the target TrueConf server over TCP port 4307, which is open by default and requires no authentication. The attacker then escalates privileges to NT AUTHORITY\SYSTEM and replaces the \public\js\locale.php file with a web shell for persistent remote access. This web shell collects sensitive environment data, accesses the TrueConf database, and swaps the hosted TrueConf Client installer for a trojanized build containing the backdoors.
Head Mare is reclassifieded from hacktivist to APT based on the sophistication of its TTPs and the absence of destructive activity such as encryption or wiping in the targeted infrastructure.
How the TrueConf server is compromised
The attack chain begins when Head Mare connects to the target TrueConf server over TCP port 4307, which is open by default and requires no authentication. The attacker then escalates privileges to NT AUTHORITY\SYSTEM and replaces the \public\js\locale.php file with a web shell for persistent remote access. This web shell collects sensitive environment data, accesses the TrueConf database, and swaps the hosted TrueConf Client installer for a trojanized build containing the backdoors.
The backdoor payload: PhantomCore and PhantomGraph
PhantomGraph is a two-DLL backdoor that Head Mare drops alongside PhantomCore. The first component, SysExcSvc.dll, handles command execution; the second, SysReadSvc.dll, reads and returns output. Both are loaded into the target process and wait for instructions.
Commands arrive over a Microsoft OneDrive account. The attacker uploads a BATCH file to the OneDrive URL, and the malware downloads and executes it locally. This split keeps the full command string out of the EDR view and matches the pattern Kaspersky saw in the main payload, where the code partially overlaps with PhantomCore.
Once the backdoor is live, the malware exfiltrates credentials through the ASS process. It then runs hostname and whoami for basic recon, and spins up a reverse SSH tunnel to give the attacker a persistent shell back into the host.
Who is being targeted
Active campaigns are targeting Russian organizations across six industries: electronics, energy, IT, instrument manufacturing, software development, and transportation. The group distributes its backdoors through multiple initial access methods observed in the wild.
Victims connect to a compromised counterparty TrueConf server to download the infected installer. As Kaspersky notes, employees join online meetings on the compromised server and pull the trojanized TrueConf Client package, which delivers the backdoors to the video conference participants.
Key points
- Head Mare exploits an unpatched TrueConf server via TCP port 4307 to connect without authentication and execute a malicious command.
- The attacker replaces the TrueConf Client installer with a trojanized version that delivers PhantomCore and PhantomGraph backdoors to video conference participants.
- PhantomGraph consists of two DLLs (SysExcSvc.dll and SysReadSvc.dll) that accept commands via a Microsoft OneDrive account and return results.
- Kaspersky is observing multiple active campaigns targeting Russian organizations in instrumentation, electronics, transportation, energy, IT, and software development sectors.
- The group previously classified as hacktivists is now reclassifieded as an APT due to TTP sophistication and lack of destructive activity.