Head Mare Exploits TrueConf Server Flaws to Push PhantomCore via Trojanized Installers — Detection and Remediation Guide

Kaspersky's incident response team has confirmed that the threat actor Head Mare is once again weaponizing vulnerabilities in unpatched TrueConf Server deployments — this time in a July 2026 campaign targeting Russian organizations across instrumentation, electronics, transport, energy, IT, and software development. The defining characteristic of this campaign is its distribution mechanism: after compromising a TrueConf server, the attackers replace the legitimate TrueConf client installers hosted on that server with versions trojanized with PhantomCore, a Go-based remote access trojan.

This is a supply-chain-style attack executed at the organizational perimeter. Every user who downloads the conferencing client from their own trusted internal server receives malware instead. The trust relationship between endpoint users and internal collaboration infrastructure is the weapon.

If you operate TrueConf Server — particularly internet-facing instances — treat this as an active-exploitation event. Verify your patch level, verify the integrity of the client installers your server distributes, and hunt for the post-exploitation behaviors detailed below.

Technical Analysis

Affected Products and Attack Surface

TrueConf Server is a self-hosted video conferencing platform widely deployed in Russia and CIS countries as a domestic alternative to Zoom and Microsoft Teams. It runs on Windows and Linux and, critically for this attack, hosts the client installer packages that end users download directly from the server itself. This architectural detail is what makes TrueConf Server such a high-value target: compromise the server, and you inherit a trusted malware distribution channel to every endpoint in the organization.

Head Mare is a hacktivist-motivated actor (active since at least 2023) that has repeatedly targeted Russian organizations, previously combining ransomware deployment with data theft. Kaspersky's prior reporting documented the group exploiting TrueConf Server vulnerabilities to gain initial access; the July 2026 activity demonstrates the group continuing to hammer the same class of flaw against organizations that never patched — and refining the payload delivery into an installer-replacement scheme using a vulnerability chain rather than a single bug.

Attack Chain (Defender's View)

1. Initial access — vulnerability exploitation: The attacker exploits a vulnerability chain in an unpatched, network-reachable TrueConf Server instance. Internet-exposed admin panels and conferencing ports are the primary surface. Successful exploitation yields code execution in the context of the TrueConf service.
2. Installer replacement: The attacker locates the directory where TrueConf Server stores the client installation packages it serves to users (Windows .exe/.msi and Linux packages) and replaces them with backdoored builds. The trojanized installer typically retains the legitimate client's functionality to avoid suspicion while embedding the PhantomCore payload.
3. Trusted distribution: End users — employees, contractors, meeting participants — download what they believe is the official client from their organization's own server. Execution of the installer drops and runs PhantomCore.
4. Post-exploitation: PhantomCore (also tracked as PhantomRAT) is a Go-compiled RAT supporting command execution, file theft, and screenshot capture. It commonly masquerades under filenames imitating legitimate software and uses scheduled tasks or Run keys for persistence. Historically, Head Mare intrusions have escalated to data exfiltration and ransomware (e.g., LockBit-based encryptors on Windows, Babuk-derived payloads on Linux/ESXi).

Exploitation Status

Confirmed active exploitation in the wild, per Kaspersky's July 2026 detection. This is not theoretical — the campaign is ongoing against unpatched servers. No CVE identifier was published in the reporting summarized here, so defenders should anchor on TrueConf's current vendor advisories and version guidance rather than a specific CVE, and treat any TrueConf Server build that is not the latest release as presumptively exposed.

The key defensive insight: the malware's entry point is a trusted internal download, not email or a drive-by. Traditional perimeter controls and email security will not see this. Detection must focus on the server (compromise and file replacement) and the endpoint (installer provenance and PhantomCore behavior).

Detection & Response

Sigma Rules

These three rules target the observable behaviors of this campaign: (1) the TrueConf server process spawning shells or interpreters post-exploitation, (2) modification of client installer files served by TrueConf, and (3) endpoint-side PhantomCore persistence via scheduled tasks masquerading as system components.

---
title: TrueConf Server Process Spawning Command Interpreter
description: Detects TrueConf Server processes spawning cmd, PowerShell, or script interpreters, consistent with post-exploitation activity following vulnerability exploitation as observed in Head Mare campaigns.
references:
  - https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/15
status: experimental
id: 9c2e4a71-6b38-4f0d-a5e2-7d1c9b3f8a44
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\\trueconf'
      - '\\tcs'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\rundll32.exe'
      - '\\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; TrueConf server components do not normally spawn interactive shells. Investigate any hit.
level: high
---
title: Modification of TrueConf Client Installer Files
description: Detects writes or modifications to TrueConf client installer packages, a hallmark of the Head Mare installer-replacement technique used to distribute PhantomCore through trusted server downloads.
references:
  - https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/08/15
status: experimental
id: 3f7b1d52-8c49-4e6a-b2d8-5a0e6c4f9b77
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\\TrueConf\\'
      - '\\trueconf\\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.msi'
      - '.deb'
      - '.rpm'
  selection_name:
    TargetFilename|contains:
      - 'client'
      - 'setup'
      - 'install'
  filter_updater:
    Image|contains:
      - '\\TrueConf\\'
  condition: selection_path and selection_ext and selection_name and not filter_updater
falsepositives:
  - Legitimate TrueConf upgrades performed by administrators; correlate with change windows.
level: high
---
title: PhantomCore-Style Scheduled Task Persistence Masquerading as System Component
description: Detects scheduled task creation where the task name or binary masquerades as a legitimate system or software component, a persistence pattern associated with PhantomCore/PhantomRAT deployments by Head Mare.
references:
  - https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html
  - https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/08/15
status: experimental
id: 6a1d8e34-2f57-4b9c-91ab-4c3e7d2f5b19
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\schtasks.exe'
    CommandLine|contains: '/create'
  selection_suspicious_paths:
    CommandLine|contains:
      - '\\AppData\\'
      - '\\ProgramData\\'
      - '\\Temp\\'
      - '\\Public\\'
  condition: selection and selection_suspicious_paths
falsepositives:
  - Software installers that register update tasks from user-writable paths; whitelist known enterprise software updaters.
level: medium

A note on tuning: the first rule is the highest-fidelity of the three — TrueConf service processes spawning shells is almost never legitimate. The installer-modification rule requires you to confirm your exact TrueConf installation path (default is under C:\Program Files\TrueConf Server on Windows; adjust the path filter to your deployment, including the directory that serves client downloads).

KQL — Microsoft Sentinel / Defender

This query hunts the two halves of the attack in a single sweep: installer tampering on the TrueConf server, and endpoint downloads/executions of TrueConf installers followed by suspicious child process behavior. It assumes Defender for Endpoint coverage (or equivalent ingestion of file/process events).

// Hunt: TrueConf installer tampering and PhantomCore delivery chain
let Lookback = 14d;
// Part 1: Non-TrueConf processes modifying TrueConf installer files (server-side replacement)
let InstallerTamper =
DeviceFileEvents
| where Timestamp > ago(Lookback)
| where FolderPath has_any ("TrueConf")
| where FileName has_any ("setup", "install", "client") and FileName endswith_any (".exe", ".msi")
| where not(InitiatingProcessFolderPath has "TrueConf")
| project TamperTime=Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
// Part 2: Endpoints executing TrueConf installers whose spawned children look like RAT staging
let InstallerExec =
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName has_any ("trueconf", "tc_client", "trueconf_setup")
    or ProcessCommandLine has_any ("trueconf")
| project ExecTime=Timestamp, DeviceName, InstallerFile=FileName, InstallerPath=FolderPath, AccountName, InitiatingProcessCommandLine;
// Part 3: Suspicious process lineage from recently executed installers
let SuspiciousChildren =
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName has_any ("trueconf", "tc_client")
    or InitiatingProcessCommandLine has "trueconf"
| where FileName in~ ("cmd.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe", "wscript.exe")
| project ChildTime=Timestamp, DeviceName, ChildProcess=FileName, ChildCommand=ProcessCommandLine, Parent=InitiatingProcessFileName;
InstallerTamper
| union InstallerExec, SuspiciousChildren
| sort by DeviceName asc

For environments ingesting TrueConf Linux servers via Syslog/CEF, pivot on Syslog where ProcessName matches the TrueConf service and look for unexpected child processes (bash, sh, curl, wget) — post-exploitation tooling almost always reaches for a downloader.

Velociraptor VQL

Use this artifact on TrueConf servers and endpoints to enumerate recently modified installer packages and flag processes executing from user-writable paths with TrueConf lineage — the two forensic artifacts most likely to survive on disk.

-- Hunt: TrueConf installer integrity and PhantomCore staging artifacts
-- Scope: TrueConf servers and endpoints that downloaded clients
LET installers <= SELECT FullPath, Mtime, Size,
       hash(path=FullPath).SHA256 AS SHA256
FROM glob(globs=['C:/Program Files/TrueConf*/**/*.exe',
                 'C:/Program Files/TrueConf*/**/*.msi',
                 '/opt/trueconf*/**/*install*',
                 '/opt/trueconf*/**/*.deb'])
WHERE Mtime > now() - 60*60*24*30
SELECT FullPath, Mtime, Size, SHA256
FROM installers
ORDER BY Mtime DESC

-- Hunt: Suspicious processes spawned by TrueConf components or running from user-writable paths
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)trueconf'
   OR Exe =~ '(?i)(appdata|programdata|temp|public)\\\\[^\\\\]+\\.(exe|dll)$'
   OR (Name =~ '(?i)^(cmd|powershell|schtasks|rundll32)'
       AND CreateTime > now() - 60*60*24*7)

Baseline the first artifact against known-good installer hashes from TrueConf's official distribution. Any hash mismatch on a server-hosted installer is a probable compromise indicator — pull the file for analysis and treat every endpoint that downloaded it as exposed.

Remediation & Verification Script

For Windows-based TrueConf servers, this script verifies the TrueConf Server version, inventories hosted client installers with hashes for comparison against vendor-known-good values, and enumerates recent modifications to the installation tree that could indicate tampering.

# TrueConf Server compromise verification — run elevated on the TrueConf server
# 1) Installed TrueConf version (compare against latest vendor release)
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'TrueConf' } |
  Select-Object DisplayName, DisplayVersion, InstallDate

# 2) Hash all hosted client installers — compare against vendor-published hashes
$tcPaths = @('C:\Program Files\TrueConf Server', 'C:\Program Files (x86)\TrueConf Server')
foreach ($p in $tcPaths) {
  if (Test-Path $p) {
    Get-ChildItem $p -Recurse -Include *.exe,*.msi -ErrorAction SilentlyContinue |
      Where-Object { $_.Name -match 'client|setup|install' } |
      Select-Object FullName, LastWriteTime, Length,
        @{N='SHA256';E={(Get-FileHash $_.FullName -Algorithm SHA256).Hash}}
  }
}

# 3) Files in the TrueConf tree modified in the last 30 days (tamper indicator)
foreach ($p in $tcPaths) {
  if (Test-Path $p) {
    Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
      Select-Object FullName, LastWriteTime | Sort-Object LastWriteTime -Descending
  }
}

# 4) Recent scheduled tasks executing from user-writable paths (PhantomCore persistence)
Get-ScheduledTask | Where-Object {
  ($_.Actions.Execute -match 'AppData|ProgramData|Temp|Public') -and
  ($_.Date -gt ((Get-Date).AddDays(-30)).ToString())
} | Select-Object TaskName, TaskPath, @{N='Action';E={$_.Actions.Execute}}

For Linux-based TrueConf servers:

# TrueConf Server (Linux) verification — run as root
# 1) Version check — compare against latest vendor release
dpkg -l 2>/dev/null | grep -i trueconf || rpm -qa 2>/dev/null | grep -i trueconf

# 2) Hash hosted client installers — compare against vendor-published known-good hashes
find /opt/trueconf* /usr/share/trueconf* -type f \( -name '*.deb' -o -name '*.rpm' -o -name '*.exe' \) \
  -exec sha256sum {} \; 2>/dev/null

# 3) Recently modified files in the TrueConf tree (potential tamper)
find /opt/trueconf* -type f -mtime -30 -printf '%T@ %TY-%Tm-%Td %TH:%TM %p\n' 2>/dev/null | sort -rn | head -50

# 4) Suspicious child processes of the TrueConf service (live check)
TCS_PID=$(pgrep -f trueconf | head -1)
[ -n "$TCS_PID" ] && ps --ppid "$TCS_PID" -o pid,ppid,user,cmd

# 5) Persistence sweep: cron and systemd units created/modified in last 30 days
find /etc/cron* /var/spool/cron /etc/systemd/system -type f -mtime -30 2>/dev/null

Remediation

1. Patch TrueConf Server immediately. Upgrade to the latest release published by TrueConf. Because Head Mare is chaining vulnerabilities against unpatched builds, "one version behind" is not good enough — confirm against the vendor's current download page and security advisories at trueconf.com and any Kaspersky-linked technical advisories describing the exploited flaws. Do not rely on auto-update being enabled; verify the running version directly using the scripts above.
2. Verify installer integrity — this is the campaign's kill chain. Hash every client installer your server hosts and compare against TrueConf's official known-good builds. Any mismatch = probable compromise. Re-download pristine installers from the vendor, replace the hosted copies, and treat all endpoints that downloaded installers from the server during the exposure window as potentially infected with PhantomCore.
3. If tampering is confirmed, invoke IR — don't just clean. Reimage the server or restore from a pre-compromise backup, rotate all credentials the server could reach (service accounts, domain credentials used on the host), and sweep endpoints for PhantomCore persistence (scheduled tasks, Run keys, binaries in AppData/ProgramData). Assume lateral movement and data theft occurred; Head Mare's historical playbook includes ransomware deployment as the endgame.
4. Reduce exposure of the management surface. Remove TrueConf admin interfaces from direct internet reach; place them behind VPN or a reverse proxy with authentication. Restrict inbound access to only the ports required for conferencing. If the server must be internet-facing, enforce strict egress filtering — a compromised conferencing server should not be able to initiate arbitrary outbound connections (this breaks PhantomCore C2 and post-exploitation downloaders).
5. Deploy file integrity monitoring on the installer directory. The single highest-value detective control for this specific technique is alerting on any modification to the packages your server distributes. FIM on that directory would have caught this campaign at the moment of replacement.
6. Segment and monitor. TrueConf servers should sit in a DMZ-style segment with no direct path to domain controllers or internal file shares. Alert on any authentication or SMB/RDP traffic originating from the conferencing server to internal assets — legitimate conferencing workloads generate almost none.
7. Track the actor. Subscribe to Kaspersky Securelist reporting on Head Mare and incorporate published IOCs into your blocklists as they are released. The group iterates quickly, and this is their second documented wave against the same product class — organizations that ignored the first round of TrueConf advisories are the ones being compromised now.

The broader lesson for defenders: any self-hosted collaboration platform that distributes its own client software is a latent supply-chain vector. Conferencing, chat, and remote-access servers deserve the same patch urgency and integrity monitoring you give your VPN concentrators — because threat actors like Head Mare have already made that calculation.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub