Head Mare Exploits TrueConf Flaws to Deliver PhantomCore Malware to Meeting Participants
Brief
The Head Mare advanced persistent threat group has been exploiting unpatched TrueConf Server instances to distribute the PhantomCore backdoor to video-conference participants.
The campaign transforms compromised enterprise collaboration servers into malware-delivery infrastructure, putting not only TrueConf administrators at risk but also employees and contractors who join hosted meetings and download the client application.
Kaspersky discovered the activity while investigating attacks targeting Russian organizations. The attackers compromised TrueConf servers and replaced the legitimate Windows x64 client distribution file with a trojanized installer.
Head Mare Exploits TrueConf Flaws
When a conference participant visits the meeting guest page, they are prompted to download or update the TrueConf client.