🟠 High | Source: The Hacker News
The Russian-linked threat actor Head Mare is exploiting unpatched vulnerabilities in TrueConf Server to replace legitimate client installers with the PhantomCore malware, targeting organisations across Russian industry sectors including energy, transport, and IT. Attackers are chaining multiple flaws to achieve this supply-chain-style compromise, meaning any user downloading the tampered installer from an internal TrueConf server could be infected. Kaspersky identified the campaign in July 2026, indicating active, ongoing exploitation.
Security Architect’s Take: If TrueConf Server is deployed in your environment, apply all available patches immediately and verify the integrity of hosted client installers using cryptographic hashes. Treat any TrueConf server exposed internally or externally as potentially compromised until fully audited, and consider restricting installer distribution to a separately controlled, authenticated repository.
Original advisory: TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore