Head Mare hits three zero-days in the wild
Head Mare is actively exploiting three zero-day vulnerabilities in the wild, according to Kaspersky, which first detected the campaign in July 2026. The three targets are Atlassian Rovo, Progress LoadMaster, and Metabase.
The headline is Progress LoadMaster, tracked as CVE-2026-8037. CISA added it to its Known Exploited Vulnerabilities catalog after observing 792 exploitation attempts. All three CVEs are being exploited in the wild, not just disclosed.
CVE-2026-8037: Progress LoadMaster in CISA KEV
The headline vulnerability is CVE-2026-8037, a flaw in Progress LoadMaster, the load balancer sitting in front of the web application. CISA added it to its Known Exploited Vulnerabilities catalog after observing 792 exploitation attempts in the wild. Because LoadMaster terminates the connection before the app, a successful exploit gives the attacker full access to the backend, not just a read-only foothold.
The other two: Rovo and Metabase
The second target is Atlassian Rovo, the AI assistant embedded in Jira and Confluence. Head Mare triggers a prompt injection that lets the model exfiltrate data directly from the backend. Kaspersky rates it HIGH severity and flags it as the primary data-exfiltration primitive in the campaign. It hits the Technology sector hardest, where Rovo is already deployed in production.
Metabase is the third zero-day. The BI tool gets zero-dayed in the same wave, giving the attacker a second foothold into the data layer. All three CVEs are live in the wild, not staged for disclosure.
Who is Head Mare
Head Mare is a Russian APT group that Kaspersky previously tracked as a hacktivist. The reclassification to APT reflects the sophistication of their TTPs and the absence of destructive activity — no encryption or wiping — in the targeted infrastructure.
The group is targeting Russian organizations across seven sectors: Electronics, Energy, IT, Instrument manufacturing, Software development, Technology, and Transportation. Kaspersky is observing multiple active campaigns, with the initial access delivered through unpatched TrueConf video conferencing servers that the attackers use to serve trojanized client installers to meeting participants.
The TrueConf supply-chain trick
Head Mare’s initial access rides on unpatched TrueConf video conferencing servers. The group connects over TCP port 4307, which is open by default, and authenticates as nobody. From there, they fire a malicious command through a flaw Kaspersky tracks as KLCERT-26-057.
The command escalates to NT AUTHORITY\SYSTEM and swaps the server’s \public\js\locale.php file with a web shell. That shell gives them persistent remote access to the compromised box.
The real trick is what the web shell does next. It replaces the legitimate TrueConf Client installer hosted on the server with a trojanized version. When meeting participants join a call, they download the infected installer and get the backdoors installed locally.
PhantomGraph is the second backdoor in the chain. It’s two DLLs — SysExcSvc.dll and SysReadSvc.dll — that take commands over a Microsoft OneDrive account, execute them, and return the output. The SysReadSvc module runs commands through a BATCH file, which Kaspersky says they split into two components to dodge EDR detection.
PhantomCore and PhantomGraph backdoors
PhantomCore is the primary backdoor, delivered to the victim when they run the trojanized TrueConf Client installer. It establishes the initial foothold on the endpoint and hands off to the C2 layer.
PhantomGraph is the command-and-control backdoor. It consists of two DLLs — SysExcSvc.dll and SysReadSvc.dll — that receive commands over a Microsoft OneDrive account, execute them, and return the output. The SysReadSvc module runs commands through a BATCH file, which the group splits into two components to evade EDR detection. A typical execution looks like $system32\cmd.exe /c cmd /c ....
Once the backdoor is live, the malware runs hostname and whoami for reconnaissance, then starts a reverse SSH tunnel. Credentials are exfiltrated via the ASS process.
Key points
- Three zero-days actively exploited in the wild: Atlassian Rovo, Progress LoadMaster, and Metabase.
- Progress LoadMaster CVE-2026-8037 added to CISA KEV with 792 exploitation attempts.
- Head Mare uses TrueConf server to deliver PhantomCore and PhantomGraph backdoors to video conference participants.
- Attackers exploit TCP port 4307 (open by default) to connect to TrueConf without authentication, then escalate to NT AUTHORITY\SYSTEM and replace locale.php with a web shell.
- PhantomGraph backdoor consists of SysExcSvc.dll and SysReadSvc.dll, accepting commands via Microsoft OneDrive and executing them on the victim.