Operation TrueChaos: Exploitation of TrueConf Zero-Day Vulnerability

• •CVE-2026-3502 allows arbitrary file execution via compromised TrueConf updates.
• •Operation TrueChaos targets government entities in Southeast Asia, attributed to a Chinese threat actor.
• •A patch for the vulnerability was released in March 2026 after the discovery.

In early 2026, a series of targeted attacks named Operation TrueChaos exploited a zero-day vulnerability in TrueConf software, tracked as CVE-2026-3502, which allows attackers to execute arbitrary files on connected endpoints. The flaw, stemming from a missing integrity check in the update mechanism, affects TrueConf versions 8.1.0 through 8.5.2. Government entities in Southeast Asia were primarily targeted, with attackers gaining control of on-premises TrueConf servers to distribute malicious updates. The campaign is attributed to a Chinese-nexus threat actor based on observed tactics and infrastructure. Following the report, a patch was released in March 2026. The attack method involved replacing legitimate updates with malicious files, impacting multiple agencies. The incident highlights significant risks for organizations using TrueConf in sensitive environments.