TL;DR CISA added two TrueConf Server flaws to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-72529 and CVE-2026-72530, both are exploited in the wild. Attackers chain them to run code and plant PhantomCore malware. Fixed versions have shipped. Why It Matters TrueConf is a widely used video conferencing and communications platform. A server breach here reaches far beyond one company.

At a glance Actor/group Head Mare (tracked by Kaspersky; reclassified from hacktivist group to APT) Activity type Exploitation of unpatched TrueConf server flaws to distribute a trojanized client and backdoors Targets/victims Russian organizations across instrument manufacturing, electronics, transportation, energy, IT, and software development; any participant connecting to a compromised TrueConf server Scale

Kaspersky reported a July 2026 Head Mare campaign that abused two TrueConf Server vulnerabilities to gain SYSTEM-level code execution, deploy a web shell, and replace legitimate client installers with infected versions carrying PhantomCore and PhantomGraph. The attackers used Microsoft OneDrive as C2 for one backdoor, installed persistence through registry and Windows services, and targeted Russian organizations across multiple industries. #TrueConf #HeadMare #PhantomCore #PhantomGraph

En juillet 2026, les chercheurs de Kaspersky ont identifié une campagne active du groupe hacktivist Head Mare exploitant une chaîne de vulnérabilités dans des serveurs TrueConf non patchés. L'analyse technique a été publiée le 7 août 2026 sur Securelist, relayée par BleepingComputer le 8 août 2026.

📅 Source : Kaspersky Securelist (https://securelist.ru), publié le 7 août 2026, mis à jour le 10 août 2026.

Head Mare has been exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with trojanized versions that deliver the PhantomCore and PhantomGraph backdoors. Kaspersky says the campaign targets Russian organizations and can impact users even through compromised third-party TrueConf servers, enabling credential theft, reconnaissance, and persistent remote access. #HeadMare #TrueConf #PhantomCore #PhantomGraph

Ghostwriter has launched new spear-phishing attacks against Ukrainian government organizations, using malicious PDFs, geofencing, and a JavaScript version of PicassoLoader to deploy Cobalt Strike. The wider report also highlights Gamaredon’s Ukraine-focused campaigns, BO Team-linked operations against Russian organizations, and Hive0117’s phishing activity for financial theft. #Ghostwriter #PicassoLoader #CobaltStrike #Gamaredon #BOTeam #HeadMare...