Head Mare Hijacks TrueConf Servers, Deploys PhantomCore

Introduction

In July 2026, security researchers at Kaspersky disclosed a sophisticated intrusion campaign attributed to the threat actor known as Head Mare. The group specifically targeted TrueConf video-conferencing servers that remained unpatched, focusing on organisations operating across a range of Russian strategic sectors including instrumentation, electronics, transport, energy, information technology, and software development. By exploiting a multi-stage vulnerability chain, the attackers were able to gain control of the server, replace the authentic installer files with a malicious version, and silently deliver the PhantomCore backdoor to any client that runs the server's automatic update routine. This supply-chain approach turned a routine maintenance function into a covert infection vector, allowing the attackers to compromise numerous endpoints without requiring end-user interaction.

Supply Chain Sabotage through TrueConf Vulnerabilities

The operation relied on a carefully sequenced exploit chain that began with a remote code execution vulnerability present in legacy TrueConf builds. This flaw enabled the adversary to execute arbitrary commands from a network position, effectively bypassing perimeter defenses. A subsequent local privilege-escalation bug granted the attacker administrative control over the compromised host, allowing full manipulation of system files. With elevated privileges, the threat actor modified the server's installer package, swapping the legitimate binary for a trojanized version that embeds the PhantomCore payload. Because the update process is automatically invoked on client machines, the malicious installer propagates silently, turning a trusted maintenance task into a mass-infection mechanism.

• The exploit chain combined a network-facing remote code execution flaw with a local privilege-escalation vulnerability, creating a seamless pathway from the internet to full system control.
• After achieving administrative rights, the attackers modified the installer archive, replacing the genuine binary with a malicious version that silently installs the PhantomCore backdoor on any client that applies the routine update.
• All compromised servers displayed anomalous changes in the installer file hash, a clear indicator that the supply-chain had been weaponized.
• The campaign leveraged the trusted update mechanism to avoid phishing emails or malicious attachments, thereby reducing the need for user interaction and increasing the likelihood of widespread compromise.

Impact on Targeted Russian Enterprises

Enterprises across the targeted industries reported a surge in anomalous server activity, including unexpected outbound network traffic, irregular process executions, and unexplained modifications to critical binaries. The breadth of the intrusion indicates that the attackers sought not only to disrupt video-conferencing services but also to establish a foothold for deeper network intrusion and potential data exfiltration. Victims observed the following repercussions:

• Compromise of internal communication tools, which may have exposed confidential project discussions, proprietary designs, and operational data.
• Potential for lateral movement within corporate networks, enabling attackers to reach sensitive environments such as SCADA systems in the energy sector or design repositories in electronics manufacturing.
• Increased exposure to secondary threats, including ransomware deployment or information-stealing modules, once the initial backdoor is established on client machines.
• Significant operational disruption, as affected servers were taken offline for forensic analysis, causing downtime and productivity loss across the affected organisations.

Conclusion

The Head Mare campaign underscores the critical importance of maintaining up-to-date software, especially for widely deployed communication platforms that serve as gateways to broader corporate networks. The ability to replace legitimate installers with malicious payloads illustrates how supply-chain attacks have become a preferred tactic for sophisticated threat actors. As the threat landscape continues to evolve, robust patch management, rigorous control over server binaries, and advanced detection capabilities remain indispensable defenses. Grivyonx Cloud provides automated threat intelligence and security orchestration that assists organisations in staying ahead of emerging risks while preserving operational continuity, without resorting to aggressive sales language.