TrueConf Server Vulnerability Exploited to Backdoor Client Installers

Attackers have spent recent months breaking into unpatched TrueConf video conferencing servers and replacing the client installer hosted on them with a backdoored build. Staff who connect to the server then receive that malicious package as a routine software update. Each TrueConf server vulnerability in the exploit chain hands the intruder a little more control, ending with full system privileges on the host.

Researchers identified the campaign in July 2026 and tied itto a hack tivist group tracked under several names, most commonly Head Mare. The operation targets Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development. Every intrusion documented so far traces back to a TrueConf server vulnerability that already had a patch available.

How the TrueConf Server Vulnerability Chain Works

Access starts with TCP port 4307. TrueConf leaves this port open by default, and attackers connect to it without supplying any credentials at all.

From there, the intruders chain two flaws. The first lets them run a malicious script inside TrueConf's isolated environment. The second breaks out of that sandbox and executes commands on the underlying operating system. Neither TrueConf server vulnerability is dramatic alone, but together they turn an exposed port into arbitrary code execution.

The attackers then escalate privileges to NTAUTHORITY\SYSTEM, the highest level available on a Windows host. Their final move on the server is to overwrite the file \public\js\locale.php with a web shell. That single file swap gives them persistent remote access long after the initial intrusion.

Turning the Update Channel Into a Delivery Mechanism

The web shell does the real damage. Operators use it to harvest sensitive information from the environment, read the TrueConf database, and reach the client installer stored on the server.

That installer is the payload. Attackers replace the legitimate version with one carrying the PhantomCore backdoor. Every employee who pulls an update from the compromised server then installs malware alongside the software they expected. The trick works because nobody questions an update served by their own infrastructure.

The trojanized installer carries no digital signature, unlike the genuine package. Exploiting a TrueConf server vulnerability gets attackers onto the machine, but the unsigned build is where the attack becomes visible to anyone checking signatures on internal software distribution.

A Second Backdoor Working Through OneDrive

Alongside PhantomCore, the group deploys PhantomGraph. This backdoor consists of two DLL files, SysExcSvc.dll and SysReadSvc.dll, and it takes instructions through a Microsoft OneDrive account rather than a dedicated command server.

Routing traffic through a mainstream cloud service helps the malware blend into ordinary network activity. Blocking it means inspecting legitimate OneDrive connections, which most security teams are reluctant to do.

Observed activity through PhantomGraph includes dumping the memory of the Local Security Authority Subsystem Service to steal credentials. Operators also run reconnaissance commands such as hostname and whoami, then open a reverse SSH tunnel.

The Risk Reaches Beyond Server Operators

This is the part that catches organizations off guard. You do not need to run TrueConf yourself.

Employees regularly join meetings hosted on servers belonging to suppliers, clients, and partners. If an external server carries an unpatched TrueConf server vulnerability, your staff can download the poisoned installer from it. The backdoor then arrives inside your network through a business relationship rather than your own infrastructure.

That makes this a counterparty problem as much as a patching problem. A security team can lock down every server it owns and still lose a workstation because one employee accepted a meeting invitation from a supplier running an outdated build.

Affected Versions and Available Fixes

Patches exist. The vendor addressed each TrueConf server vulnerability in versions 5.3.9, 5.4.9, and 5.5.5, all released on June 18, 2026.

Anything running 5.3.x below 5.3.9, 5.4.x below 5.4.9, 5.5.xbelow 5.5.5, or an older branch entirely remains exposed. Attackers moved fast once that release revealed what to look for, and active exploitation surfaced roughly a month later. Every unpatched TrueConf server vulnerability stays alive entry point until administrators install the fix.

Administrators should also review whether port 4307 needs to be reachable from outside the network. Restricting it removes the entry point even on systems awaiting a patch.

Not the First Campaign Against This Platform

TrueConf has drawn sustained attention from multiple threat groups. The same actor cluster behind the current attacks has been probing these servers in Russia since September 2025, using an earlier exploit chain built from three separate flaws.

A different campaign surfaced in April 2026. Attackers abused a zero-day arbitrary file execution flaw tracked as CVE-2026-3502, and that operation also pushed malicious client updates to victims. Analysts tentatively linked it to a Chinese threat actor.

Two unrelated groups reached the same conclusion. TrueConf serves as an on-premise alternative to Zoom and Microsoft Teams for enterprise and government users in Russia. Its self-hosted update mechanism makes any TrueConf server vulnerability valuable to anyone seeking quiet access to sensitive networks.

What Organizations Should Do Now

Patching is the immediate step, but it does not undo an existing compromise. Treat any server that ran a vulnerable build as suspect until proven otherwise.

Check \public\js\locale.php for unexpected modifications, review client installers for missing digital signatures, and audit systems for the PhantomGraph DLLs. Rotate credentials on every affected machine, because LSASS dumping means passwords have likely already left the building.

This campaign is also a useful prompt to look at how software reaches endpoints. Companies choose on-premise deployments precisely to limit third-party exposure, yet a compromised update channel undermines that logic completely. A TrueConf server vulnerability sitting unpatched turns your own distribution point into the attacker's, and trust in that infrastructure is only as sound as the patching discipline behind it.