Head Mare Exploits TrueConf Server Flaws to Distribute Backdoored Client Installers

Overview of the Attack

The hacktivist group Head Mare has been exploiting security flaws in unpatched TrueConf video conferencing servers. The attackers replaced legitimate client installers with malicious versions that deliver the PhantomCore and PhantomGraph backdoors.

These backdoored installers allow attackers to gain persistent remote access, exfiltrate credentials, and conduct reconnaissance on compromised systems. The attacks were detected by cybersecurity company Kaspersky in July.

Targeted Organizations and TrueConf's Role

The attacks primarily targeted Russian companies across multiple sectors, including instrumentation, electronics, transport, energy, IT, and software development. TrueConf is widely used in Russia, particularly in enterprise and government sectors, as an on-premise alternative to Western video conferencing tools.

The affected TrueConf server versions include 5.3.x up to 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and earlier versions.

Exploited Vulnerabilities and Attack Chain

Head Mare leveraged a chain of vulnerabilities, internally tracked by Kaspersky as KLCERT-26-057 and KLCERT-26-058. These flaws enable arbitrary code execution with elevated privileges.

The attack chain begins with attackers connecting to the TrueConf server on TCP port 4307, which is open by default. They then exploit KLCERT-26-057 to run a malicious script within TrueConf's isolated environment. KLCERT-26-058 is used to escape this sandbox and execute commands on the underlying operating system. Attackers then escalate privileges to NT AUTHORITY\SYSTEM and replace the ‘\public\js\locale.php’ file with a web shell for persistent remote access.

Impact of the Backdoors

The PhantomCore and PhantomGraph backdoors provide attackers with capabilities such as persistent remote access and the ability to collect infrastructure data. This allows for ongoing surveillance and data exfiltration from compromised networks.