[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvtUZjsIFZZTk3BM_xZF8Wbr8j1CvmBBPb0swECFuM48":3,"$fw3ZlYyzTDTlPDhFkYCZvrVooqwYU_YqtFBBZmTELo2Q":46},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":43,"created_at":44,"updated_at":45,"published_at":29},"head-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan","Head Mare APT trojanizes TrueConf client installers to drop PhantomCore and PhantomGraph backdoors","Kaspersky found the group exploiting an unpatched TrueConf server to replace the client installer with a malicious version that delivers two new backdoors to video conference participants.","Head Mare APT is exploiting an unpatched TrueConf video conferencing server to trojanize the client installer and deliver PhantomCore and PhantomGraph backdoors to Russian organizations across six sectors.",[10,11,12,13,14],"Head Mare","TrueConf","PhantomCore","PhantomGraph","APT","# Head Mare APT trojanizes TrueConf client installers to drop PhantomCore and PhantomGraph backdoors\n\n*Kaspersky found the group exploiting an unpatched TrueConf server to replace the client installer with a malicious version that delivers two new backdoors to video conference participants.*\n\n**Tags:** `Head Mare` `TrueConf` `PhantomCore` `PhantomGraph` `APT`\n\n> Head Mare APT is exploiting an unpatched TrueConf video conferencing server to trojanize the client installer and deliver PhantomCore and PhantomGraph backdoors to Russian organizations across six sectors.\n\n---\n\n## Head Mare APT trojanizes TrueConf client installers\n\nKaspersky detected a new Head Mare campaign in July 2026 targeting unpatched TrueConf servers. The group exploits a vulnerability tracked internally as KLCERT-26-057 to replace the legitimate TrueConf Client installer with a malicious version, delivering backdoors to video conference participants.\n\nThe attack chain begins when Head Mare connects to the target TrueConf server over TCP port 4307, which is open by default and requires no authentication. The attacker then escalates privileges to NT AUTHORITY\\SYSTEM and replaces the `\\public\\js\\locale.php` file with a web shell for persistent remote access. This web shell collects sensitive environment data, accesses the TrueConf database, and swaps the hosted TrueConf Client installer for a trojanized build containing the backdoors.\n\nHead Mare is reclassifieded from hacktivist to APT based on the sophistication of its TTPs and the absence of destructive activity such as encryption or wiping in the targeted infrastructure.\n\n## How the TrueConf server is compromised\n\nThe attack chain begins when Head Mare connects to the target TrueConf server over TCP port 4307, which is open by default and requires no authentication. The attacker then escalates privileges to NT AUTHORITY\\SYSTEM and replaces the `\\public\\js\\locale.php` file with a web shell for persistent remote access. This web shell collects sensitive environment data, accesses the TrueConf database, and swaps the hosted TrueConf Client installer for a trojanized build containing the backdoors.\n\n## The backdoor payload: PhantomCore and PhantomGraph\n\nPhantomGraph is a two-DLL backdoor that Head Mare drops alongside PhantomCore. The first component, SysExcSvc.dll, handles command execution; the second, SysReadSvc.dll, reads and returns output. Both are loaded into the target process and wait for instructions.\n\nCommands arrive over a Microsoft OneDrive account. The attacker uploads a BATCH file to the OneDrive URL, and the malware downloads and executes it locally. This split keeps the full command string out of the EDR view and matches the pattern Kaspersky saw in the main payload, where the code partially overlaps with PhantomCore.\n\nOnce the backdoor is live, the malware exfiltrates credentials through the ASS process. It then runs hostname and whoami for basic recon, and spins up a reverse SSH tunnel to give the attacker a persistent shell back into the host.\n\n## Who is being targeted\n\nActive campaigns are targeting Russian organizations across six industries: electronics, energy, IT, instrument manufacturing, software development, and transportation. The group distributes its backdoors through multiple initial access methods observed in the wild.\n\nVictims connect to a compromised counterparty TrueConf server to download the infected installer. As Kaspersky notes, employees join online meetings on the compromised server and pull the trojanized TrueConf Client package, which delivers the backdoors to the video conference participants.\n\n## Key points\n\n- Head Mare exploits an unpatched TrueConf server via TCP port 4307 to connect without authentication and execute a malicious command.\n- The attacker replaces the TrueConf Client installer with a trojanized version that delivers PhantomCore and PhantomGraph backdoors to video conference participants.\n- PhantomGraph consists of two DLLs (SysExcSvc.dll and SysReadSvc.dll) that accept commands via a Microsoft OneDrive account and return results.\n- Kaspersky is observing multiple active campaigns targeting Russian organizations in instrumentation, electronics, transportation, energy, IT, and software development sectors.\n- The group previously classified as hacktivists is now reclassifieded as an APT due to TTP sophistication and lack of destructive activity.\n\n## Further reading & sources\n\n- [Head Mare delivers PhantomCore and PhantomGraph backdoors via an unpatched TrueConf server | Securelist](https:\u002F\u002Fsecurelist.com\u002Ftr\u002Fhead-mare-targets-trueconf-server-with-phantomcore\u002F120988) — Kaspersky Securelist\n- [Hackers breach TrueConf to trojanize client installers with backdoors](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-breach-trueconf-to-trojanize-client-installers-with-backdoors\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan.png?v=b570cfa52f",{"iocs":18,"actors":24,"malware":30,"timeline":33,"technologies":38},[19,22],{"type":20,"value":21},"other","SysReadSvc.dll",{"type":20,"value":23},"SysExcSvc.dll",[25],{"url":26,"name":10,"slug":27,"type":28,"origin":29,"motivation":29},"\u002Fthreat-groups\u002Fhead-mare","head-mare","unknown",null,[31,32],{"name":12},{"name":13},[34],{"date":35,"event":36,"description":37},"2026-07","Attack Detected","Kaspersky experts detected a new attack by the Head Mare group.",[39,41],{"vendor":11,"product":40},"TrueConf Server",{"vendor":11,"product":42},"TrueConf Client","campaign","2026-08-28T17:23:49.323621+00:00","2026-10-16T12:29:06.730818+00:00",{"articles":47},[48,61,74,86],{"slug":49,"title":50,"summary":51,"tags":52,"hero_image_url":58,"story_type":59,"created_at":60},"head-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog","Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster","The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.",[10,53,54,55,56,57],"zero-day","Atlassian Rovo","Progress LoadMaster","Metabase","CVE-2026-8037","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog.png?v=48acc20ab2","vulnerability_disclosure","2026-09-22T12:04:22.141581+00:00",{"slug":62,"title":63,"summary":64,"tags":65,"hero_image_url":71,"story_type":72,"created_at":73},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has identified a new APT group, Armored Likho, running a multi-stage spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer to steal credentials, browser data, and documents from government and critical infrastructure targets in Russia, Brazil, and Kazakhstan.",[66,67,68,14,69,70],"Armored Likho","BusySnake Stealer","Kaspersky","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","threat_actor_activity","2026-09-19T12:06:09.947355+00:00",{"slug":75,"title":76,"summary":77,"tags":78,"hero_image_url":84,"story_type":72,"created_at":85},"honeymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor","HoneyMyte adds kernel-mode rootkit to CoolClient backdoor","HoneyMyte (Mustang Panda) APT has upgraded its CoolClient backdoor with a new Windows kernel-mode rootkit, Msagent.sys, that provides process hiding, file hiding, registry hiding, and network data filtering for deeper persistence and stealth in targeted intrusions across Asia and Russia.",[79,80,81,82,83,14],"HoneyMyte","Mustang Panda","CoolClient","Msagent.sys","Windows kernel rootkit","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhoneymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor.png?v=81f9bb1ed5","2026-08-29T12:13:55.8896+00:00",{"slug":87,"title":88,"summary":89,"tags":90,"hero_image_url":96,"story_type":43,"created_at":97},"sophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t","Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware","Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.",[91,92,93,94,95],"The Gentlemen","Sophos X-Ops","AI brand impersonation","malvertising","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t.png?v=7a1343b754","2026-09-30T07:09:51.117027+00:00"]