Hackers Compromise TrueConf Servers to Distribute Trojanized Video‑Conferencing Client Installers
What Happened — The Head Mare hacktivist group exploited two unpatched vulnerabilities in on‑premise TrueConf video‑conferencing servers, used an unauthenticated TCP 4307 listener, and gained SYSTEM privileges. They installed web‑shells, replaced the legitimate client installer with a back‑doored version (PhantomCore) and deployed a secondary backdoor (PhantomGraph) that harvested credentials and executed commands.
Why It Matters for Compliance & Audit Readiness
- This supply‑chain style compromise directly violates SOC 2’s Change Management and Software Integrity criteria, which require documented controls over code signing, installer distribution, and unauthorized modification detection.
- Continuous evidence of patch management, port hardening, and installer integrity can serve as audit‑ready proof that the organization mitigates the exact risk demonstrated here.
Who Is Affected – Enterprises and government agencies in Russia that run TrueConf on‑premise, as well as any third‑party organizations that join meetings hosted on compromised TrueConf servers.
Recommended Actions –
- Map the incident to SOC 2 CC6.1 (Change Management) and CC6.2 (Software Integrity) controls; verify that all installer binaries are digitally signed and integrity‑checked before deployment.
- Deploy continuous monitoring for unauthorized file changes on TrueConf servers and close non‑essential ports (e.g., 4307).
- Accelerate patching of the identified vulnerabilities (KLCERT‑26‑057, KLCERT‑26‑058) and enforce a formal vulnerability‑remediation workflow.
Source: BleepingComputer
Technical Notes –
- Attack vector: Exploitation of two server‑side vulnerabilities (KLCERT‑26‑057, KLCERT‑26‑058) and default open TCP 4307 listener.
- Backdoors: PhantomCore (persistent remote access) and PhantomGraph (OneDrive‑controlled DLLs).
- Data types: Extracted LSASS memory for credential harvesting; potential exposure of internal network topology and privileged accounts.