Head Mare Hackers Exploit TrueConf Vulnerabilities to Deploy Backdoors

• •Head Mare exploited vulnerabilities in TrueConf servers to deploy backdoors.
• •PhantomCore and PhantomGraph backdoors were installed via compromised client installers.
• •Kaspersky identified the attack in July 2026, affecting Russian organizations across multiple sectors.

The Head Mare hacktivist group has breached TrueConf video conferencing servers, exploiting vulnerabilities to replace legitimate client installers with malicious versions containing backdoors. The attackers executed arbitrary code with high privileges using two vulnerabilities tracked as KLCERT-26-057 and KLCERT-26-058, allowing them to deploy the PhantomCore and PhantomGraph backdoors. TrueConf, a tool widely used in Russia's enterprise and government sectors, is now compromised, affecting organizations even if they do not directly use the service. Kaspersky discovered the attack in July 2026, and the threat actor is actively targeting various sectors, including energy and IT. The vulnerabilities affect multiple versions of TrueConf Server, and patches have been released to mitigate the risks.