TrueConf trojanized installers: vet counterparty downloads

Here is a trojanized installer delivery path that skips your vendor list entirely. Attackers broke into unpatched TrueConf video conferencing servers and swapped the legitimate client installer for a backdoored copy. The infected party is not the company running the server. It is everyone who clicked "join meeting" and downloaded the client it offered.

What actually happened

Kaspersky discovered the campaign in July and attributed it to the Head Mare group, per BleepingComputer's August 8 report. The chain is short and ugly:

• Attackers connect to the target TrueConf server over TCP port 4307, open by default, without authentication.
• Two flaws Kaspersky tracks internally as KLCERT-26-057 and KLCERT-26-058 let them run a script inside TrueConf's isolated environment, then escape that sandbox and execute commands with top privileges. A separate zero-day, CVE-2026-3502, was reported by CheckPoint back in April 2026.
• They then replace the TrueConf Client installer hosted on the server with a version carrying the PhantomCore and PhantomGraph backdoors. PhantomGraph uses Microsoft OneDrive for command and control, so its traffic looks like normal business file sync.

Affected builds are TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, and 5.5.x before 5.5.5. The fixes shipped June 18, 2026 — before the campaign Kaspersky found in July. This was an unpatched-server problem, not a zero-day problem.

The targeting is currently Russian organizations across instrumentation, electronics, transport, energy, IT, and software development. The mechanism is not regional. Kaspersky's own warning is the line to read twice: even if your organization does not run a TrueConf server, your employees can connect to a compromised counterparty's server for a meeting and download an infected package from it.

Why this supply chain attack bypasses your vendor review

Your vendor security review covers software you bought. This attack delivers through software you did not buy, hosted by a company you do not have a contract with, downloaded by an employee who was just trying to make a 10am call. There is no procurement gate in that path. There is no vendor questionnaire that catches it.

Two controls actually help here, and neither is exotic.

Stop letting endpoints install arbitrary downloads. On managed machines, application installation should require an admin the user is not. This is a Windows Defender Application Control or Intune policy on Windows, a Gatekeeper plus MDM policy on macOS — and it is the single control that turns "employee downloaded a backdoor" into "employee filed a ticket." If you have never enforced it because it seemed heavy-handed, this is the threat model it exists for.

Default to the browser for external meetings. Most conferencing platforms have a web client. A browser tab is a far better sandbox than an installer with SYSTEM rights, and it removes the download step that this entire attack depends on. Make "join in browser" the house rule for any meeting hosted by someone outside your company.

Then the boring part: if you do run a TrueConf server, you are late. Get to 5.3.9, 5.4.9, or 5.5.5 today, and treat every client installer that server distributed since June as suspect. Hunt for OneDrive-based C2 from workstations that have no business syncing to it.

The general lesson keeps repeating. A patch that shipped in June and was not applied in July is indistinguishable from a zero-day when it lands on you.

Sources: BleepingComputer, The Hacker News.