Head Mare Hacktivists Trojanize TrueConf Client Installers: Detection and Hardening Guide for Exposed Video Conferencing Servers

---
title: TrueConf Server Process Spawning Command Shell
id: 3f8a1c92-7e4d-4b6a-9c15-2d8f4a1b7e33
status: experimental
description: Detects TrueConf server processes spawning cmd.exe, powershell.exe, or shell interpreters, consistent with post-exploitation activity observed in Head Mare server compromises.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\trueconf.exe'
      - '\tcfserver.exe'
      - '\TrueConfServer.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare vendor update or maintenance scripts invoked by the server service
level: high
---
title: Modification of Installer Files in TrueConf Distribution Directory
id: 8b2e4d17-5f93-4a2c-b741-9e3d6c2a5f88
status: experimental
description: Detects writes to client installer files (EXE/MSI) in TrueConf server download/distribution paths by processes other than the TrueConf server itself, consistent with attacker replacement of installers with trojanized versions.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\TrueConf\'
  selection_name:
    TargetFilename|endswith:
      - '.exe'
      - '.msi'
  filter_updater:
    Image|endswith:
      - '\trueconf.exe'
      - '\tcfserver.exe'
      - '\msiexec.exe'
      - '\TiWorker.exe'
      - '\TrustedInstaller.exe'
  condition: selection_path and selection_name and not filter_updater
falsepositives:
  - Administrators manually deploying updated client installers
  - Configuration management tools pushing client packages
level: high
---
title: Suspicious Child Process From TrueConf Client Installer
id: 5c7d2a84-1b6f-4e93-ad28-7f4b9e1c3d12
status: experimental
description: Detects trojanized TrueConf client installer behavior where the installer spawns scripting engines, shell commands, or unsigned binaries outside normal installation patterns.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'TrueConfClient'
      - 'trueconf'
    ParentImage|endswith:
      - '.exe'
      - '.msi'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Some legitimate installer custom actions; verify against a known-good installer from the vendor
level: high

// Hunt 1: Server-side compromise - TrueConf server spawning shells
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("trueconf", "tcfserver", "TrueConfServer")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "mshta.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc
;
// Hunt 2: Endpoint-side - suspicious child processes from TrueConf client installer
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName startswith "TrueConf" or InitiatingProcessCommandLine has_any ("TrueConfClient", "trueconf")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc
;
// Hunt 3: New outbound connections from recently installed TrueConf client (possible backdoor C2)
let Installs = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName startswith "TrueConf" or ProcessCommandLine has "TrueConfClient"
| summarize InstallTime = min(TimeGenerated) by DeviceName;
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has "TrueConf"
| join kind=inner Installs on DeviceName
| where TimeGenerated between (InstallTime .. InstallTime + 4h)
| where RemoteIPType == "Public"
| project DeviceName, InstallTime, TimeGenerated, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc

-- TrueConf trojanized installer triage hunt
-- Pulls recent installer file modifications, suspicious process lineage, and persistence artifacts
LET installers = SELECT FullPath, Mtime, Size,
       hash(path=FullPath).SHA256 AS SHA256
FROM glob(globs='C:/Program Files*/TrueConf*/**/*.exe')
WHERE Mtime > now() - 1209600

LET suspicious_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'powershell|cmd.exe|wscript|cscript|mshta|regsvr32|rundll32'
  AND (CommandLine =~ 'trueconf' OR Exe =~ 'TrueConf')

LET run_keys = SELECT FullPath, Name, Data
FROM glob(globs='/HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*', accessor='registry')
WHERE Data =~ 'trueconf' OR Data =~ 'AppData\\\\.*\\\\.*\\.exe'

SELECT * FROM installers
UNION ALL SELECT * FROM suspicious_procs

# TrueConf Compromise Verification Script - Security Arsenal
# Run elevated. Review output carefully before any removal action.

$report = @()

# 1. Inventory installed TrueConf components
Write-Host "[+] Installed TrueConf components:" -ForegroundColor Cyan
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
                 HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Where-Object { $_.DisplayName -match 'TrueConf' } |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallDate |
    Format-Table -AutoSize

# 2. Hash all hosted client installers (server-side distribution directory)
Write-Host "[+] Hashing installer binaries in TrueConf paths (compare against vendor-published hashes):" -ForegroundColor Cyan
$paths = @("C:\Program Files\TrueConf", "C:\Program Files (x86)\TrueConf")
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.exe, *.msi -ErrorAction SilentlyContinue |
            ForEach-Object {
                $h = Get-FileHash $_.FullName -Algorithm SHA256
                $report += [PSCustomObject]@{
                    File = $_.FullName; SHA256 = $h.Hash
                    LastWrite = $_.LastWriteTime; Signed = (Get-AuthenticodeSignature $_.FullName).Status
                }
            }
    }
}
$report | Format-Table -AutoSize

# 3. Flag unsigned or invalidly signed TrueConf binaries
Write-Host "[+] Checking digital signatures on TrueConf binaries:" -ForegroundColor Cyan
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.exe -ErrorAction SilentlyContinue |
            ForEach-Object {
                $sig = Get-AuthenticodeSignature $_.FullName
                if ($sig.Status -ne 'Valid') {
                    Write-Host "    [!] UNSIGNED/INVALID: $($_.FullName) - $($sig.Status)" -ForegroundColor Red
                }
            }
    }
}

# 4. Persistence check: Run keys and scheduled tasks referencing TrueConf or user-profile paths
Write-Host "[+] Checking persistence mechanisms:" -ForegroundColor Cyan
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
                 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue |
    Out-String | Select-String -Pattern 'TrueConf|AppData.*\.exe' -AllMatches | ForEach-Object { $_.Line }
Get-ScheduledTask | Where-Object { $_.TaskName -match 'TrueConf' -and $_.Author -notmatch 'TrueConf|Microsoft' } |
    Select-Object TaskName, TaskPath, Author | Format-Table -AutoSize

# 5. Network anomaly check: TrueConf processes with non-TrueConf public connections
Write-Host "[+] Active connections from TrueConf processes:" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name -match 'TrueConf' } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess,
        @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Format-Table -AutoSize

Write-Host "[+] Review complete. Compare hashes and signatures against official TrueConf builds." -ForegroundColor Green