Head Mare APT Exploits TrueConf Video Conferencing Servers to Deliver PhantomCore Malware: OTX Pulse Analysis — Supply Chain Detection Pack

---
title: Head Mare PhantomCore - Trojanized TrueConf Installer Execution
id: 9c4f2a1e-7b3d-4e8f-a2c1-6d5e8f9a0b11
status: experimental
description: Detects execution of TrueConf client installer that spawns unexpected child processes, indicative of the Head Mare trojanized installer delivering PhantomCore.
author: Security Arsenal Threat Intel
references:
    - https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware
date: 2026/09/20
logsource:
    category: process_creation
    product: windows
level: high
detection:
    selection_parent:
        ParentImage|contains:
            - '\trueconf'
        ParentImage|endswith:
            - 'setup.exe'
            - 'installer.exe'
            - '.msi'
    selection_suspicious_children:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\schtasks.exe'
            - '\reg.exe'
    condition: selection_parent and selection_suspicious_children
falsepositives:
    - Legitimate TrueConf installation scripts in managed enterprise deployments
tags:
    - attack.t1195.002
    - attack.t1059
---
title: Head Mare PhantomCore - Persistence via Fake Conferencing Updater
id: 2a8b3c4d-5e6f-4a1b-9c2d-8e7f0a1b2c33
status: experimental
description: Detects registry Run key or scheduled task persistence referencing video conferencing or updater naming conventions used by PhantomCore.
author: Security Arsenal Threat Intel
references:
    - https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware
date: 2026/09/20
logsource:
    category: registry_set
    product: windows
level: high
detection:
    selection_reg:
        TargetObject|contains:
            - '\CurrentVersion\Run'
            - '\CurrentVersion\RunOnce'
    selection_value:
        Details|contains:
            - 'trueconf'
            - 'confupdate'
            - 'confsvc'
            - 'meeting'
    filter_legit:
        Image|endswith:
            - '\TrueConf\Client\TrueConf.exe'
            - '\TrueConf.exe'
    condition: selection_reg and selection_value and not filter_legit
falsepositives:
    - Legitimate TrueConf autoupdate mechanisms (verify signed binary path)
tags:
    - attack.t1060
    - attack.t1547.001
---
title: Head Mare - Web Shell on TrueConf Server via Suspicious Child of Server Process
id: 7f1e2d3c-4b5a-4c6d-8e9f-0a1b2c3d4e55
status: experimental
description: Detects TrueConf server process spawning shells or scripting interpreters, consistent with post-exploitation and web shell deployment observed in the Head Mare campaign.
author: Security Arsenal Threat Intel
references:
    - https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware
date: 2026/09/20
logsource:
    category: process_creation
    product: windows
level: critical
detection:
    selection_parent:
        ParentImage|contains:
            - 'trueconf'
            - 'tcserver'
            - 'tc_'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\nltest.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Administrative maintenance scripts executed in server context (rare; investigate all hits)
tags:
    - attack.t1190
    - attack.t1505.003
    - attack.t1059

// Head Mare PhantomCore hunt: trojanized TrueConf installer activity + persistence artifacts
let Lookback = 30d;
let IoCHashes = dynamic([
    "0e4541c3153ec5ed01497f19cf4f63d0",
    "0e79996d9483d1e44fea32b0a48c2c19",
    "129462164a7d52e9ea8560b60f0412c5",
    "12d4e8f5295f2ef7e0f9bfc0f4830939",
    "2bb75c20e778eb5c416965bd4d4259b1",
    "43f435c3c437bc879a2d7d4634f43494",
    "489f43be558b2679284ceabed7adc4f3",
    "4d27b4eb1c5dbb3d8160f29b8119523e"
]);
// Part 1: Any host that executed TrueConf installers, joined with IoC hash matches and suspicious child processes
let InstallerExec = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any ("trueconf", "setup.exe", "installer.exe") or ProcessCommandLine has "trueconf"
    | where MD5 in~ (IoCHashes) or SHA1 in~ (IoCHashes) or InitiatingProcessMD5 in~ (IoCHashes)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, MD5, SHA256, AccountName, InitiatingProcessFileName;
// Part 2: Suspicious child processes spawned by conferencing software
let SuspiciousChildren = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName has_any ("trueconf", "tcserver")
    | where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","rundll32.exe","regsvr32.exe","wscript.exe","mshta.exe","schtasks.exe","reg.exe","certutil.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
// Part 3: Network connections from TrueConf binaries to non-standard destinations
let SuspiciousNet = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName has_any ("trueconf", "phantom")
    | where RemoteIPType == "Public"
    | where not(RemoteUrl has_any ("trueconf.com", "trueconf.ru"))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl;
union InstallerExec, SuspiciousChildren, SuspiciousNet
| sort by TimeGenerated desc

# Head Mare / PhantomCore endpoint hunt — run fleet-wide via EDR/Intune/GPO scheduled task
# Checks persistence, trojanized installer hashes, and suspicious network state
$ErrorActionPreference = 'SilentlyContinue'
$iocMD5 = @(
    '0e4541c3153ec5ed01497f19cf4f63d0','0e79996d9483d1e44fea32b0a48c2c19',
    '129462164a7d52e9ea8560b60f0412c5','12d4e8f5295f2ef7e0f9bfc0f4830939',
    '2bb75c20e778eb5c416965bd4d4259b1','43f435c3c437bc879a2d7d4634f43494',
    '489f43be558b2679284ceabed7adc4f3','4d27b4eb1c5dbb3d8160f29b8119523e'
)
$findings = @()

# 1) Hash sweep of TrueConf install/download locations
$paths = @("$env:ProgramFiles\TrueConf","${env:ProgramFiles(x86)}\TrueConf",
           "$env:LOCALAPPDATA\TrueConf","$env:TEMP","$env:USERPROFILE\Downloads")
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -Include *.exe,*.msi,*.dll -ErrorAction SilentlyContinue |
            ForEach-Object {
                $h = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
                if ($iocMD5 -contains $h) {
                    $findings += [PSCustomObject]@{Type='IOC_HASH_MATCH'; Path=$_.FullName; MD5=$h}
                }
            }
    }
}

# 2) Persistence: Run keys referencing conferencing/updater naming
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        (Get-Item $k).Property | ForEach-Object {
            $v = (Get-ItemProperty $k -Name $_).$_
            if ($v -match 'trueconf|confupdate|confsvc|meeting' -and $v -notmatch 'TrueConf\\Client\\TrueConf.exe') {
                $findings += [PSCustomObject]@{Type='PERSISTENCE_RUNKEY'; Path="$k\$_"; MD5=$v}
            }
        }
    }
}

# 3) Scheduled tasks masquerading as conferencing updaters
Get-ScheduledTask | Where-Object {
    $_.TaskName -match 'conf|meeting|trueconf' -and
    ($_.Actions.Execute -notmatch 'TrueConf\\Client' ) -and
    $_.Actions.Execute -match 'powershell|cmd|rundll32|regsvr32|wscript|mshta'
} | ForEach-Object {
    $findings += [PSCustomObject]@{Type='SUSPICIOUS_TASK'; Path=$_.TaskName; MD5=$_.Actions.Execute}
}

# 4) Active connections from TrueConf processes to public IPs
Get-NetTCPConnection -State Established |
    Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)' } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc -and $proc.Path -match 'trueconf|phantom') {
            $findings += [PSCustomObject]@{Type='NETWORK_CONNECTION'; Path=$proc.Path; MD5="$($_.RemoteAddress):$($_.RemotePort)"}
        }
    }

if ($findings) { $findings | Format-Table -AutoSize; $findings | Export-Csv "$env:TEMP\headmare_hunt_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation }
else { Write-Output "[+] No Head Mare/PhantomCore artifacts found on $(hostname)" }