PhantomCore Backdoor Exploits TrueConf Server Vulnerabilities

In modern enterprise cybersecurity, few attack vectors present as insidious a threat as server-side supply-chain compromise. When attackers compromise an internal collaboration tool—specifically video conferencing platforms—they do not merely breach a single host; they inherit a trusted vector to distribute malicious code directly to every end-user within and outside the enterprise. A major cyber attack campaign highlighting this reality centers on the weaponization of critical flaws in TrueConf Server deployments by the hacktivist threat group known as Head Mare. By exploiting a multi-stage vulnerability chain, attackers have systematically overwritten legitimate client installation packages hosted on compromised servers, transforming routine client software updates into a distribution engine for the PhantomCore backdoor. This campaign highlights how threat actors exploit zero-day and unpatched server vulnerabilities to breach high-value targets across critical infrastructure, electronics, transport, energy, IT, and software development sectors.

Deconstructing the Vulnerability Chain: KLCERT-26-057 and KLCERT-26-058

The operational mechanics of this attack campaign rely on a flaw combination affecting public-facing TrueConf Server instances. By targeting server installations exposing default communication configurations, threat actors initiate an unauthenticated attack sequence that leads directly to complete host compromise and administrative takeover.

Step 1: Unauthenticated Initial Access via Port 4307 (KLCERT-26-057)

The initial entry point relies on default network configurations inherent to TrueConf Server deployments. By default, TrueConf Server instances listen for incoming connections on TCP port 4307 over public-facing networks. Threat actors scan for public IP ranges hosting open 4307 ports and connect directly to the service without requiring prior authentication. Upon establishing a connection, the attackers exploit the flaw identified as KLCERT-26-057. This vulnerability allows an unauthenticated remote attacker to invoke server-side functions and supply arbitrary scripts to be executed on the server.

Under normal operational constraints, TrueConf Server isolates script execution within a restricted sandbox environment. This containerized sandbox is designed to limit script interactions, preventing direct calls to native operating system functions or filesystem paths. However, while KLCERT-26-057 alone provides remote script execution within this isolated context, it serves as the essential foothold for the second phase of the exploit chain.

Step 2: Sandbox Breakout and Full OS Command Execution (KLCERT-26-058)

To bypass the security boundaries imposed by the sandbox, Head Mare leverages a secondary zero-day vulnerability tracked as KLCERT-26-058. This flaw represents a privilege escalation and container breakout vulnerability within the server’s execution framework. By chaining KLCERT-26-058 with the script injection capabilities of KLCERT-26-057, the attackers break out of the restricted sandbox environment entirely.

Once sandbox constraints are neutralized, injected commands execute directly in the context of the host operating system. Because TrueConf Server processes typically run with elevated background permissions on Windows environments, the exploit chain grants attackers full arbitrary code execution under NT AUTHORITY\SYSTEM privileges. At this point, the underlying host server is completely compromised, granting the threat actors unrestricted read, write, and administrative rights over the entire TrueConf server application stack and local filesystem.

Web Shell Injection and Database Hijacking for Persistence

Achieving administrative command execution is only the beginning of the attack lifecycle. To establish resilient persistence and prepare for long-term supply-chain manipulation, Head Mare pivots from initial exploitation to internal component modification.

Immediately following privilege escalation, the attackers modify internal web application files on the server. Specifically, they overwrite the legitimate PHP file located at the relative path ...\public\js\locale.php with a custom web shell. Replacing this localized script gives the threat actors a web-accessible, persistent backdoor that bypasses standard authentication controls and remains active even if server services restart.

Through this newly planted web shell, Head Mare executes detailed host and network reconnaissance. The web shell facilitates several critical post-exploitation operations:

• Infrastructure Reconnaissance: Enumerating local network topology, active directory domain configurations, connected user sessions, and internal network adapters.
• Database Manipulation: Gaining privileged access to the backend TrueConf relational database, enabling the extraction of internal user directories, hashed credentials, meeting schedules, and system configurations.
• Distribution Directory Modification: Modifying file permissions and access controls within the web server’s public distribution folders, paving the way for software installer poisoning.

Poisoning the Supply Chain: Deployment of the PhantomCore Backdoor

The true threat multiplier of this campaign lies in its supply-chain vector. Rather than relying on traditional email phishing or direct endpoint scanning to infect workstation endpoints, Head Mare leverages the compromised TrueConf server as a trusted software repository.

Once administrative control over the filesystem is established, threat actors locate the official client installer packages hosted on the server. They replace the legitimate TrueConf Client installation executables with modified, trojanized installers. Because these files are downloaded directly from the organization’s official internal or partner TrueConf server URL, end-users, IT staff, and external contractors have no reason to suspect malicious activity.

When an employee attempts to update client software or an external participant downloads the client to join a secure meeting session hosted on the compromised server, the server delivers the trojanized installer. Upon execution, the installer seamlessly installs the legitimate videoconferencing software while silently dropping and executing the PhantomCore backdoor in the background.

Architectural Breakdown of the PhantomCore Backdoor

The PhantomCore backdoor is a sophisticated implant framework engineered for stealth, system discovery, and persistent remote access. Once launched on an endpoint, PhantomCore carries out a structured sequence of malicious actions:

• Host Fingerprinting & Reconnaissance: The implant collects detailed system metadata, including hostname, OS version, public and private IP addresses, system architecture, active process lists, and logged-in user tokens.
• Credential Harvesting: It extracts cached user credentials, browser tokens, and local system secrets to facilitate lateral movement across the internal enterprise network.
• C2 Communication Mechanisms: PhantomCore utilizes modern networking libraries, such as Boost.Beast for WebSocket-based communications, establishing encrypted outbound sessions to threat-actor-controlled command and control (C2) domains.
• Secondary Payload Delivery: PhantomCore acts as a downloader for additional offensive tooling, including credential dumpers, custom network scanners, and ransomware payloads such as LockBit or Babuk.

Co-Deployment of the PhantomGraph RAT via Cloud Services

In tandem with the PhantomCore backdoor, the compromised infrastructure and web shells are leveraged to deploy another advanced malware family codenamed PhantomGraph. Sharing significant code overlap and design patterns with PhantomCore, PhantomGraph operates as a specialized Remote Access Trojan (RAT) designed to evade traditional perimeter defenses.

PhantomGraph utilizes a dual DLL module architecture that decouples command handling from network communications. Crucially, PhantomGraph leverages commercial cloud storage APIs—specifically Microsoft OneDrive—for command and control traffic. By routing C2 commands and exfiltrated data through legitimate OneDrive endpoints, PhantomGraph blends seamlessly into normal corporate network traffic, bypassing traditional Domain Name System (DNS) blocklists and Secure Web Gateway (SWG) filters.

Threat Actor Profile: The Operational Evolution of Head Mare

The threat group responsible for this campaign, known as Head Mare, has operated as an active hacktivist collective targeting corporate and industrial entities since 2023. Historically, the group relied on lower-complexity initial access vectors, such as widespread spear-phishing campaigns delivering malicious archive files exploiting older client-side vulnerabilities like CVE-2023-38831 in WinRAR.

However, the weaponization of the TrueConf Server vulnerability chain (KLCERT-26-057 and KLCERT-26-058) marks a significant evolution in Head Mare’s technical capabilities and operational posture. By adopting server-side zero-day exploitation and supply-chain installer poisoning, Head Mare demonstrates a move toward highly effective, multi-tier operational methodologies typical of advanced persistent threat (APT) groups.

The group’s ultimate objectives extend beyond simple access broker activities or political messaging. By deploying backdoors like PhantomCore alongside destructive ransomware families, Head Mare achieves dual objectives: prolonged cyber espionage through undetected intelligence gathering, followed by severe operational disruption via enterprise-wide encryption.

Affected System Matrix & Severity Evaluation

Organizations operating self-hosted or cloud-managed instances of TrueConf Server must evaluate their exposure immediately. The vulnerability chain impacts a broad spectrum of releases running across enterprise environments.

The following software versions are confirmed to contain the critical security flaws:

1. TrueConf Server 5.3.x Branch: All versions prior to release 5.3.9.
2. TrueConf Server 5.4.x Branch: All versions prior to release 5.4.9.
3. TrueConf Server 5.5.x Branch: All versions prior to release 5.5.5.
4. Legacy Installations: All earlier unsupported software branches and legacy server builds.

Comprehensive Defense Blueprint and Remediation Strategy

Mitigating the threat posed by the PhantomCore backdoor and securing videoconferencing infrastructure against supply-chain poisoning requires an immediate, defense