Die Hacktivistengruppe „Head Mare“ nutzt laut Kaspersky ungepatchte TrueConf-Server, um legitime Client-Installer durch manipulierte Versionen zu ersetzen. Über ein vermeintliches Update installieren die Angreifer die Backdoors PhantomCore und PhantomGraph.

Kaspersky experts have discovered malicious TrueConf software installers. The Head Mare APT group uses them to deliver the PhantomCore and PhantomGraph backdoors to target systems by exploiting vulner...

Kaspersky reported a July 2026 Head Mare campaign that abused two TrueConf Server vulnerabilities to gain SYSTEM-level code execution, deploy a web shell, and replace legitimate client installers with infected versions carrying PhantomCore and PhantomGraph. The attackers used Microsoft OneDrive as C2 for one backdoor, installed persistence through registry and Windows services, and targeted Russian organizations across multiple industries. #TrueConf #HeadMare #PhantomCore #PhantomGraph

The Head Mare APT group exploited two zero-day vulnerabilities in TrueConf Server to distribute the PhantomCore and PhantomGraph backdoors to meeting participants. The attack, detected in July 2026, came after patches were released on June 18, 2026, exposing an overlooked threat model: participant s

Kaspersky experts have discovered malicious TrueConf software installers. The Head Mare APT group uses them to deliver the PhantomCore and PhantomGraph backdoors to target systems by exploiting vulnerabilities in an unpatched TrueConf server.

En juillet 2026, les chercheurs de Kaspersky ont identifié une campagne active du groupe hacktivist Head Mare exploitant une chaîne de vulnérabilités dans des serveurs TrueConf non patchés. L'analyse technique a été publiée le 7 août 2026 sur Securelist, relayée par BleepingComputer le 8 août 2026.

📅 Source : Kaspersky Securelist (https://securelist.ru), publié le 7 août 2026, mis à jour le 10 août 2026.

Sicherheitsforscher von Kaspersky haben eine gezielte Kampagne der Hacktivisten-Gruppe Head Mare aufgedeckt, bei der Installationsprogramme der Kommunikationssoftware TrueConf mit Schadsoftware infiziert wurden. Die Angreifer nutzen dabei spezifische Sicherheitslücken in den Server-Strukturen aus, um legitime Client-Installer durch manipulierte Versionen zu ersetzen. In den betroffenen Installationsdateien wurden die Backdoors PhantomCore und PhantomGraph identifiziert, die den Akteuren einen […] The post TrueConf-Installer: Head Mare infiziert Software mit Backdoors appeared first on BornCity.

Head Mare explota vulnerabilidades en TrueConf sin parches para inyectar backdoors PhantomCore y PhantomGraph en instaladores comprometidos.

Hackers exploram falhas em servidores TrueConf desatualizados para distribuir instaladores modificados com os backdoors PhantomCore e PhantomGraph.

The

Head Mare has been exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with trojanized versions that deliver the PhantomCore and PhantomGraph backdoors. Kaspersky says the campaign targets Russian organizations and can impact users even through compromised third-party TrueConf servers, enabling credential theft, reconnaissance, and persistent remote access. #HeadMare #TrueConf #PhantomCore #PhantomGraph