Head Mare Exploits TrueConf Servers with PhantomCore

In July 2026, the Head Mare APT group (previously categorized as hacktivists) launched a sophisticated campaign targeting organizations in Russia across various sectors including energy, transportation, and IT. The group exploited two vulnerabilities in TrueConf Server (KLCERT-26-057 and KLCERT-26-058) to achieve remote code execution with NT AUTHORITY\SYSTEM privileges.

Technically, the attackers used these vulnerabilities to bypass sandbox restrictions and deploy a PHP web shell. This shell was then used to replace legitimate TrueConf Client installers with infected versions containing the PhantomCore backdoor. Additionally, they deployed PhantomGraph, a modular backdoor utilizing Microsoft OneDrive for Command and Control (C2) infrastructure.

This campaign represents a significant escalation in Head Mare's tradecraft, moving from disruptive hacktivism to targeted espionage. Organizations using TrueConf Server versions prior to 5.3.9, 5.4.9, or 5.5.5 are at high risk and should update immediately to prevent supply-chain style compromise of their internal users.