Kaspersky reported a July 2026 Head Mare campaign that abused two TrueConf Server vulnerabilities to gain SYSTEM-level code execution, deploy a web shell, and replace legitimate client installers with infected versions carrying PhantomCore and PhantomGraph. The attackers used Microsoft OneDrive as C2 for one backdoor, installed persistence through registry and Windows services, and targeted Russian organizations across multiple industries. #TrueConf #HeadMare #PhantomCore #PhantomGraph
Keypoints
- Head Mare is now assessed by Kaspersky as an APT group because of its sophisticated TTPs and lack of destructive encryption or wiping activity.
- The campaign abused two TrueConf Server vulnerabilities, tracked internally as KLCERT-26-057 and KLCERT-26-058, to execute code with NT AUTHORITYSYSTEM privileges.
- Attackers accessed TrueConf servers over port 4307/TCP, which is open by default, and affected multiple TrueConf versions before vendor patches.
- A web shell was planted by replacing
...publicjslocale.php, enabling infrastructure reconnaissance, database access, and installer replacement. - Infected TrueConf client installers were used to deliver PhantomCore, while a second backdoor, PhantomGraph, was deployed using web-shell access.
- PhantomGraph used two components, SysExcSvc.dll and SysReadSvc.dll, with Microsoft OneDrive serving as the command-and-control channel for one module.
- The attackers pursued persistence via a registry key and Windows services, and also performed LSASS-related reconnaissance, memory dumping, and SSH tunneling.
MITRE Techniques
- [T1190 ] Exploit Public-Facing Application – The attackers exploited TrueConf Server vulnerabilities to gain initial access and execute code (‘connect to the TrueConf server without prior authorization via port 4307/TCP’).
- [T1059.004 ] Command and Scripting Interpreter: Unix Shell – The attackers executed commands through batch/command processing on the server (‘SysReadSvc module executes commands using a BATCH file’).
- [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – Commands were launched through cmd.exe to run malicious batch files (‘$system32cmd.exe /c cmd /c “”$tempcmd_cmd_4488.bat””‘).
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – A Base64-encoded PowerShell command was used to install services for persistence (‘execute a Base64-encoded PowerShell command that installs SysExcSvc.dll and SysReadSvc.dll as Windows services’).
- [T1068 ] Exploitation for Privilege Escalation – The second vulnerability allowed escape from the isolated environment and execution as SYSTEM (‘bypass the restrictions of the isolated environment and proceed to execute commands’).
- [T1505.003 ] Server Software Component: Web Shell – Attackers replaced locale.php with a web shell for remote control (‘replace the file …publicjslocale.php with a web shell’).
- [T1105 ] Ingress Tool Transfer – The attackers replaced the TrueConf client distribution with an infected version to deliver PhantomCore (‘replacing the original TrueConf Client distribution with an infected version’).
- [T1112 ] Modify Registry – Persistence was created with a registry key under HKCUSoftwareClassesCLSID…InprocServer32 (‘To automatically launch the malware after the system boots, a registry key is created’).
- [T1543.003 ] Create or Modify System Process: Windows Service – SysExcSvc and SysReadSvc were installed as services for persistence (‘installs SysExcSvc.dll and SysReadSvc.dll as Windows services’).
- [T1003.001 ] OS Credential Dumping: LSASS Memory – The attackers attempted LSASS memory dumping and access (‘Memory dump of the lsass.exe process’).
- [T1053.005 ] Scheduled Task/Job: Scheduled Task – Not mentioned explicitly; omitted.
- [T1090.001 ] Proxy: Internal Proxy – An SSH reverse tunnel was launched to provide access (‘Launching an SSH reverse tunnel’).
- [T1218.011 ] System Binary Proxy Execution: Rundll32 – Not mentioned explicitly; omitted.
- [T1102.001 ] Web Service: OneDrive – OneDrive was used as the C2 channel for SysExcSvc (‘The attackers used an account on Microsoft OneDrive cloud storage as their command-and-control (C2) server’).
Indicators of Compromise
- [IP addresses] Infrastructure/C2-related IPs mentioned in the article – 81.177.32[.]121, 94.87.239[.]71, and 194.87.93[.]153.
- [Domains] Domains associated with attacker infrastructure – penzadogshelter[.]site, trendy-market[.]site, and vks.gossopka[.]forum.
- [File names] Malicious and related binaries/scripts – locale.php, trueconf_windows_update.exe, SysExcSvc.dll, SysReadSvc.dll, and graphi_refresh.dat.
- [File paths] Dropped or abused paths on Windows/Linux systems – C:WindowsSystem32inetsrvSysExcSvc.dll, %TEMP%cmd_cmd_*.bat, and %LOCALAPPDATA%TrueConfClientapi-ms-win-crt-time-l1-1-0-2.dll.
- [Registry keys] Persistence-related registry entry – HKEY_CURRENT_USERSoftwareClassesCLSID{0340F119-A598-4ed9-B0AC-6F6A12D3E755}InprocServer32.
- [MD5 hashes] Examples tied to the web shell and infected installer – 4d27b4eb1c5dbb3d8160f29b8119523e and 748c9f8cb1065000616204935f96207f, plus other listed hashes.
- [SHA-256 hashes] Examples tied to PhantomCore/PhantomGraph components – c5a460e4e68a088f6e51b2c6474642ec129462164a7d52e9ea8560b60f0412c5 and dd1fd2b459b97b7d59375cb8383cd19a, plus other listed hashes.
- [Windows service names] Services created for persistence – SysExcSvc and SysReadSvc.
Read more: https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/