Video conferencing vendor TrueConf has confirmed a supply chain attack in which hackers hijacked servers and swapped legitimate client installers for backdoored versions. The intrusions, attributed by Kaspersky to the hacktivist group Head Mare, targeted unpatched TrueConf servers and used them to hand malicious software to anyone who downloaded the client.
The attack is a textbook example of why a single unpatched server can poison an entire software distribution chain. Rather than break into every victim’s machine directly, the attackers tampered with the download that victims trust the most: the installer straight from the vendor.
How the breach worked
Head Mare exploited two vulnerabilities, tracked as KLCERT-26-057 and KLCERT-26-058, to gain a foothold on TrueConf servers. The chain started with unauthenticated access over TCP port 4307, the default port TrueConf uses, and escalated all the way to SYSTEM-level privileges inside the isolated environment the software runs in.
Once in, the attackers deployed a web shell that let them reach the TrueConf database and tamper with the client installer the server hosts. That malicious installer carried a backdoor called PhantomCore, with a second implant, PhantomGraph, used for command and control routed through OneDrive. The replaced installer was unsigned, which is a tell for anyone trained to check, but most users simply run the file they downloaded from the vendor.
Who was affected
Kaspersky tied the campaign to victims in the Russian IT, energy, and transportation sectors, which matches Head Mare’s history of politically motivated attacks against Russian infrastructure. The group has been active since around 2024 and is known for targeting Russian organizations with destructive and espionage-focused operations.
The practical reach is wider than the named victims. Any organization that downloaded a TrueConf client from a compromised server during the window of the attack is at risk, even if it has not been publicly identified. Supply chain attacks do not respect the boundaries of who was originally targeted.
Patch status and timeline
TrueConf released fixes on June 18, 2026, in versions 5.3.9, 5.4.9, and 5.5.5. Servers running anything older, meaning 5.3.x below 5.3.9, 5.4.x below 5.4.9, or 5.5.x below 5.5.5, are exposed to the exploited flaws. The patch window matters because the vulnerabilities were the entry point; updating closes the door that let the attackers in.
What to do if you use TrueConf
If your organization runs TrueConf, the response has two parts. The server must be patched, and every client that has downloaded an installer needs to be checked.
- Update the TrueConf server to 5.3.9, 5.4.9, or 5.5.5 (whichever line you are on) immediately.
- Treat any client installer downloaded before the patch as potentially malicious, and reinstall from a freshly downloaded, verified copy.
- Scan client machines for indicators of PhantomCore and PhantomGraph, the backdoors tied to this campaign.
- Review outbound connections to OneDrive or unusual SSH tunnels, which are the channels these implants use to call home.
- Check the certificate signature on any TrueConf installer before running it. The trojanized files were unsigned.
How this compares to other vendor compromises
TrueConf is far from the first vendor to be hit this way, and it will not be the last. The pattern of tampering with a trusted download to deliver a backdoor shows up across the industry, from package repositories to enterprise software portals. What changes is the scale of trust each target carries. A conferencing tool that runs widely inside organizations is a high-value target because the installer gets deployed onto machines that then connect to corporate networks.
The Head Mare playbook also highlights a common weakness: the assumptions built into isolated environments. The vulnerabilities exploited here were not in the conferencing feature set but in how the server isolated and ran its own components. That is a reminder that sandboxing and isolation are only as strong as the code enforcing them, and that even “isolated” services need patching on the same cadence as everything else.
Why this keeps happening
Supply chain attacks like this one are attractive to attackers for a simple reason: they scale. One compromised build server or distribution point reaches thousands of users who all trust the vendor’s download. The attacker does the work once and collects access across the whole customer base.
The defense is not glamorous, but it is effective. Patch servers promptly, treat vendor downloads as a supply chain step that deserves verification, and watch for the signatures of tampering. Default ports and unpatched software are the openings these campaigns lean on, and closing them is the most reliable way to stay out of the blast radius.
There is also a quieter lesson for anyone who runs third-party software in an isolated or air-gapped environment. Isolation reduces the number of ways attackers can reach a system, but it does nothing to protect the software a trusted source hands you. When the vendor itself is the vector, isolation is no defense at all. That is why verifying what you install, not just securing what you run, has to be part of the routine.
For TrueConf customers, the message is direct: patch the server, then hunt the clients. The server is the root, but the backdoors are already on the branches.