Executive Summary
In July 2026, the Head Mare APT group was observed exploiting two newly identified vulnerabilities (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf video conferencing servers. By chaining these flaws, attackers achieved arbitrary code execution with NT AUTHORITY\SYSTEM privileges, allowing them to replace legitimate server components with a web shell and Trojanize client installation packages.
The group utilized these compromised servers to deliver PhantomCore and PhantomGraph backdoors to conference participants. PhantomGraph is notable for its use of Microsoft OneDrive as a Command-and-Control (C2) mechanism, split into two functional DLLs to evade detection. The campaign targeted multiple Russian industries, shifting from hacktivism to more sophisticated APT tradecraft.
This activity represents a significant supply-chain risk as users connecting to a compromised partner's server may be prompted to download infected updates. Organizations are urged to update TrueConf Server to versions 5.3.9, 5.4.9, or 5.5.5 immediately.