TrueConf Server Under Active Exploitation: CISA KEV Directive, Detection and Remediation Guide

CISA has added two vulnerabilities in TrueConf Server — the self-hosted video conferencing and unified communications platform from TrueConf — to its Known Exploited Vulnerabilities (KEV) catalog and ordered U.S. federal civilian agencies to remediate them under Binding Operational Directive (BOD) 22-01. KEV inclusion is not a theoretical exercise: it means CISA has reliable evidence that threat actors are exploiting these flaws in the wild right now.

The truncated public reporting does not name CVE identifiers, CVSS scores, or the specific vulnerable components, and CISA's KEV entries for these flaws emphasize confirmed active exploitation over technical detail. That is the pattern we see when exploitation telemetry is still being collected and CISA wants defenders patching rather than debating. So this post focuses on what is actionable: the exploitation status, the attack surface TrueConf Server exposes, how to hunt for compromise on your own deployments, and how to remediate.

Why this matters beyond the federal mandate

BOD 22-01 legally binds Federal Civilian Executive Branch (FCEB) agencies, typically with a remediation deadline of roughly three weeks from KEV listing. But CISA's own guidance is explicit: every organization running affected software should treat KEV entries as patch-now priorities. If you run TrueConf Server — on-prem or in a DMZ — you are operating internet-facing collaboration infrastructure that threat actors have already demonstrated they can weaponize. Self-hosted communications platforms are high-value targets: they hold credentials, meeting metadata, contact directories, and in many configurations direct access to internal networks.

Technical Analysis

Affected product and platform

• Product: TrueConf Server (self-hosted/on-premises video conferencing and UC platform)
• Platforms: Windows Server and Linux (TrueConf ships server builds for both)
• Exposure model: TrueConf Server is frequently deployed with web-facing components — the guest/client web application, admin console, and signaling/WebRTC services — to support external participants, which puts it directly in the line of fire for opportunistic scanning and exploitation.

What we know about the vulnerabilities

Public reporting confirms the following:

1. Two distinct vulnerabilities in TrueConf Server are affected.
2. Both are actively exploited in the wild — this is the criterion for KEV inclusion under BOD 22-01.
3. CISA has directed federal agencies to prioritize patching, which signals the exploitation is significant enough to warrant emergency-style remediation rather than routine patch cycles.

What is not public in the source reporting: the CVE identifiers, the vulnerable component (web console, signaling service, file transfer, API endpoints), the exploitation vector (pre-auth vs. post-auth, remote code execution vs. traversal), and attribution. Until the vendor advisory and KEV entries publish full technical detail, defenders should assume the worst-case profile for an internet-facing server product: remotely reachable, potentially pre-authentication, and capable of yielding code execution or credential theft on the host.

That assumption drives a rational defensive posture: patch immediately, hunt for prior compromise, and reduce exposure.

Exploitation status

• Confirmed active exploitation: Yes (KEV criterion met)
• CISA KEV: Listed (two entries for TrueConf Server)
• Public PoC: Not confirmed in the source reporting — but KEV listing means working exploits exist in the wild regardless of public PoC availability
• Federal remediation deadline: Per BOD 22-01, typically ~3 weeks from KEV listing — check the KEV catalog entry for the exact due date

Why self-hosted collaboration servers are attractive targets

From an IR perspective, servers like TrueConf sit in a dangerous blind spot in many environments:

• They are often excluded from EDR coverage because they are "appliance-like" or managed by a non-security team (AV/telecom).
• They run with elevated privileges (the TrueConf service commonly runs as SYSTEM on Windows or root on Linux).
• They are internet-facing by design — external guests must reach them.
• They are rarely patched quickly because they are treated as availability-critical meeting infrastructure.
• A foothold on the conferencing host yields credentials, address books, meeting intelligence, and a pivot point into the internal network.

That combination — high privilege, broad exposure, weak monitoring — is exactly what makes a KEV-level threat.

Detection & Response

Because the public reporting does not disclose specific exploit indicators (no filenames, hashes, URLs, or request patterns), the honest defensive play is behavioral hunting on the TrueConf host: the server process spawning shells or interpreters, unexpected child processes, outbound connections from the service to unusual destinations, and web-log anomalies against TrueConf's HTTP components. These are the post-exploitation behaviors you can reliably catch regardless of which of the two flaws was used for initial access.

Treat the TrueConf host as potentially already compromised if it was internet-facing and unpatched during the exploitation window — patch and hunt in parallel, not sequentially.

Sigma rules

Deploy these on any Windows host running TrueConf Server. Adjust the process name (tcserver.exe, and the TrueConf install path) if your build differs — validate against a clean host first.

---
title: TrueConf Server Process Spawning Shell or Script Interpreter
id: 3f8a1c6e-9b2d-4f47-a1c5-8e6d2b4f9012
status: experimental
description: Detects the TrueConf Server service process spawning command shells or script interpreters, a strong post-exploitation indicator for web-facing server compromise.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\tcserver.exe'
      - '\trueconfserver.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; TrueConf server software does not legitimately spawn shells in normal operation. Validate any vendor update/upgrade workflow.
level: high
---
title: Webshell-Style File Creation in TrueConf Web Directories
id: 7c4e2b91-5d38-4a6f-b2e1-9f3c7a5d8204
status: experimental
description: Detects creation of script or executable files inside TrueConf Server web-served directories, consistent with webshell deployment after exploitation of an internet-facing server.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\TrueConf\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.php'
      - '.jsp'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate TrueConf upgrades and component installs. Correlate with change windows; alert outside of them.
level: high
---
title: TrueConf Service Initiating Outbound Connection to Rare External Host
id: b1d7e4f2-8a36-4c59-d7b3-2e8f6a1c9347
status: experimental
description: Detects the TrueConf Server process establishing outbound connections to ports rarely used by conferencing traffic, a potential C2 or data-staging indicator following compromise.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\tcserver.exe'
      - '\trueconfserver.exe'
    DestinationPort:
      - 4444
      - 5555
      - 6666
      - 8443
      - 9001
      - 1337
  condition: selection
falsepositives:
  - Non-standard but legitimate conferencing port configurations. Baseline your deployment's egress profile before enabling.
level: medium

A note on fidelity: the first two rules are high-confidence post-exploitation behaviors — a conferencing server spawning cmd.exe or dropping script files into its own web root is not normal in any environment I've operated. The third rule is environment-dependent; baseline TrueConf's legitimate egress before you enable it broadly, or scope it to a watchlist of known-bad destinations instead of ports.

KQL — Microsoft Sentinel / Defender

This query hunts TrueConf hosts for suspicious child processes and webshell-style file writes across both Defender telemetry and Sysmon/SecurityEvent ingestion. Run it against any device with "trueconf" in the name, then expand to your full server fleet if the host naming convention doesn't include the product name.

// Hunt post-exploitation behaviors on TrueConf Server hosts
let TrueConfHosts = DeviceInfo
    | where DeviceName has_any ("trueconf", "tcsrv", "vcserver")
    | summarize by DeviceId, DeviceName;
let SuspiciousChildren = DeviceProcessEvents
    | where DeviceId in (TrueConfHosts)
    | where InitiatingProcessFileName has_any ("tcserver.exe", "trueconfserver.exe")
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                          "cscript.exe", "mshta.exe", "rundll32.exe", "wmic.exe",
                          "net.exe", "net1.exe", "whoami.exe", "nltest.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              InitiatingProcessFileName, AccountName, SHA256;
let WebWrites = DeviceFileEvents
    | where DeviceId in (TrueConfHosts)
    | where FolderPath has "TrueConf"
    | where FileName endswith_any (".aspx", ".ashx", ".php", ".jsp", ".ps1", ".bat", ".exe")
    | project TimeGenerated, DeviceName, FolderPath, FileName,
              InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
union SuspiciousChildren, WebWrites
| sort by TimeGenerated desc

If your TrueConf deployment is on Linux, hunt the Syslog table for the same pattern — the conferencing daemon forking a shell — plus unexpected listeners:

// Linux TrueConf hosts: shell spawned by service context, new listeners, suspicious cron/systemd persistence
Syslog
| where TimeGenerated > ago(14d)
| where HostName has_any ("trueconf", "tcsrv")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "base64 -d",
                               "nc -l", "ncat", "python -c", "crontab", "systemctl enable")
| project TimeGenerated, HostName, ProcessName, SyslogMessage, SeverityLevel
| sort by TimeGenerated desc

Velociraptor VQL

For a targeted hunt on a suspected-compromised TrueConf host, this artifact enumerates processes whose parent or executable path matches the TrueConf installation, plus their network connections — the fastest way to spot a shell or tunnel hanging off the service.

-- Hunt for suspicious child processes and network connections on TrueConf Server hosts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)trueconf'
   OR CommandLine =~ '(?i)(cmd\.exe|powershell|/bin/sh|/bin/bash|nc |ncat|base64)'

-- Enumerate network connections from TrueConf-related processes
SELECT Pid, Name, CommandLine,
       netstat().Pid AS ConnPid, netstat().Status AS ConnStatus
FROM pslist()
WHERE Exe =~ '(?i)trueconf'

If the first artifact returns shells, interpreters, or download cradles parented to the TrueConf service, you are past "vulnerability management" and into incident response: isolate the host, capture memory, and scope for lateral movement before you reimage.

Remediation verification script

TrueConf ships on both Windows and Linux. Use the following to inventory the deployment, capture the running version for comparison against the vendor's fixed release, check service privilege context, and pull the web access logs you will need for retro-hunting suspicious requests against the admin console and guest portal.

#!/bin/bash
# TrueConf Server exposure and version audit — run as root on the TrueConf host

echo "=== TrueConf service status and version ==="
systemctl status trueconf 2>/dev/null || service trueconf status 2>/dev/null

# Package version (adjust to rpm on RHEL-based distros)
dpkg -l 2>/dev/null | grep -i trueconf
rpm -qa 2>/dev/null | grep -i trueconf

echo "=== Service user context (should NOT be root if vendor supports otherwise) ==="
ps -eo user,comm,args | grep -i trueconf | grep -v grep

echo "=== Listening ports — confirm only expected conferencing/admin ports are exposed ==="
ss -tlnp | grep -iE 'trueconf|:80|:443|:8888|:4307'

echo "=== Recent web access log anomalies (scanner probes, traversal, encoded payloads) ==="
find /opt/trueconf /var/log -name '*.log' -mtime -14 2>/dev/null | while read -r f; do
  grep -aiE '\.\./|%2e%2e|cmd=|/bin/sh|base64|\${jndi' "$f" && echo "--> HIT in $f"
done

echo "=== Unexpected outbound connections from TrueConf processes ==="
ss -tnp 2>/dev/null | grep -i trueconf

echo "=== Cron/systemd persistence created in last 14 days ==="
find /etc/cron* /var/spool/cron /etc/systemd/system -mtime -14 -type f 2>/dev/null

On Windows Server deployments, the equivalent triage is:

# TrueConf host triage — run elevated
Get-Service | Where-Object { $_.DisplayName -match 'TrueConf' } | Format-List Name, Status, StartType
Get-Process | Where-Object { $_.Path -match 'TrueConf' } |
  Select-Object Name, Id, Path, StartTime | Format-List

# Service account context — SYSTEM context means full host compromise if exploited
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'TrueConf' } |
  Select-Object Name, StartName, PathName

# Listening ports owned by TrueConf processes
Get-NetTCPConnection -State Listen |
  Where-Object { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path -match 'TrueConf' } |
  Select-Object LocalAddress, LocalPort, OwningProcess

# Recently modified files under the TrueConf install tree — look for webshells/dropped tooling
Get-ChildItem 'C:\Program Files\TrueConf' -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
  Select-Object FullName, LastWriteTime

Remediation

1. Identify every TrueConf Server instance in your environment — including shadow deployments. Collaboration servers are frequently stood up by AV or facilities teams outside IT's CMDB. Sweep your asset inventory, EDR console, and external attack surface for TrueConf fingerprints (default web portal banners, known listening ports, certificate metadata).

2. Patch immediately to the vendor-fixed release. Pull the current TrueConf Server build directly from the vendor (https://trueconf.com) and confirm against the TrueConf security advisories / release notes which build remediates the two KEV-listed flaws. Do not assume your installed version is current — TrueConf does not auto-update by default on many deployments. Verify the running version post-patch, not just the installer version.

3. Meet the CISA deadline if you are federal; adopt it if you are not. BOD 22-01 sets a binding due date on the KEV entry — check https://www.cisa.gov/known-exploited-vulnerabilities-catalog for the exact date. Private-sector organizations should hold themselves to the same window; KEV-listed flaws are being exploited at scale.

4. If you cannot patch within 24-48 hours, reduce exposure now:

   • Remove the TrueConf web portal and admin console from direct internet exposure; front them with a VPN or an authenticated reverse proxy.
   • Restrict inbound access to the admin interface to a named management subnet.
   • Egress-filter the TrueConf host: it needs to reach conferencing peers and vendor update servers, not arbitrary internet destinations. This single control blunts most post-exploitation C2 and data staging.

5. Hunt before you trust. If the server was internet-facing and unpatched during the exploitation window, assume compromise until proven otherwise. Run the detection content above, review web access logs for the 30 days preceding the patch, and inspect for persistence (new services, scheduled tasks, cron entries, webshells, unexpected local accounts). If you find post-exploitation indicators, treat it as an IR engagement — patching a compromised host does not evict the attacker.

6. Fix the systemic gaps that made this dangerous:

   • Bring the TrueConf host under EDR coverage and centralized log collection.
   • Move the service off SYSTEM/root if the vendor supports a lower-privilege context.
   • Add TrueConf to your patch-management SLA for internet-facing systems (24-72 hour target for KEV-listed flaws, per your vulnerability management policy — if you don't have a KEV-specific SLA, write one this week).
   • Subscribe to the CISA KEV feed or a derivative alerting service so KEV additions page your on-call, not your backlog.

KEV additions for niche, self-hosted platforms follow a familiar arc: the vendor's install base is small, patching discipline is weaker than for mainstream enterprise software, and attackers know it. The federal directive is the loudest signal you will get. Patch the host, hunt it for prior compromise, and close the monitoring gap — in that order.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub