TrueConf Server was at the center of a serious campaign, as the Head Mare group compromised unpatched servers and replaced official installers with versions containing backdoors. Kaspersky research, which was highlighted by BleepingComputer, shows that the attack can also affect organizations connecting to a partner server.
The attackers exploited vulnerabilities in older versions of TrueConf Server to gain elevated privileges on the server. They then installed a persistent web shell, extracted information from the database, and modified a local JavaScript file so that users would receive an unsigned and malicious program upon update.
See also: PhantomCore exploits TrueConf vulnerabilities on Russian networks
How TrueConf Server was hacked
According to findings attributed to Kaspersky, TCP port 4307 is open by default and allowed unauthenticated connections to exposed servers. The chain included two internal identifiers, KLCERT-26-057 and KLCERT-26-058, the first allowing execution of a malicious script in the isolated environment and the second leading to an exit to the operating system.
After initial access, the attackers elevated their privileges to NT AUTHORITY\\SYSTEM and replaced the public/js/locale.php with a web shell. The file acted as a persistent remote control mechanism, allowing data collection from the organization's environment and access to the TrueConf Server database.
The attack was not limited to installing a simple malicious file. Taking control of the server gave the attackers the ability to exploit the trust that exists between the video conferencing platform and end users. Installing an update from an internal or partner server can seem completely normal, especially when the user does not see a warning from the operating system.
Kaspersky detected the activity in July, and the Head Mare group has been linked to previous attacks on organizations in Russia and Belarus. This history increases the risk for targeted businesses, but does not mean that organizations outside of these regions should consider the threat irrelevant to their own environment.
TrueConf Server turned into a distribution mechanism
The most dangerous stage was the replacement of the legitimate TrueConf Client program hosted on the server. When employees connected to a compromised server for video conferencing, they could download a modified update without a valid digital signature. Thus, a compromise of a central system could be transferred to the endpoints of cooperating organizations.
Head Mare also installed PhantomCore and PhantomGraph. The latter consists of two DLL files, SysExcSvc.dll and SysReadSvc.dll, which accept commands via a OneDrive account and return results. The activity included system identification, a memory dump of the LSASS process to steal credentials, and the creation of a reverse SSH tunnel.
The case reminds us that the security of an installer does not only depend on whether it comes from a known manufacturer. It also depends on the integrity of the system that hosts it, the protection of the update mechanism, and whether workstations verify the signature before executing new code.
See also: CISA: TrueConf vulnerability in KEV Directory
Updating and checking TrueConf Server installations
TrueConf released the patched versions 5.3.9, 5.4.9 and 5.5.5 on June 18 and recommends an immediate upgrade. Versions 5.2 and older require contacting technical support. TrueConf's related update states that the patches are available for free and asks to create a backup before installation.
Administrators should check if port 4307 is accessible from the internet, look for changes in public/js/locale.php, and examine for the presence of PhantomCore, PhantomGraph, and their DLLs. In case of a breach, server isolation, changing credentials, and checking connected workstations are required.
At the same time, organizations using third-party video conferencing services should notify the responsible vendors and request confirmation of the server version. Simply updating the local endpoint is not enough if the server providing the package remains exposed or has already been compromised.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The SecNews technical team recommends that TrueConf Client programs be downloaded exclusively from the official page. TrueConf's authenticity check instruction describes comparing the MD5 checksum of the .exe file with the value published on the official download page, before each installation or upgrade.
See also: ChocoPoC RAT: Attacks on security researchers via fake PoC repos
