The software supply chain carries an old dilemma: we trust the final product, but we rarely stop to think about everything it goes through before reaching our machines. The campaign that Kaspersky revealed in August 2026 turns that trust into a weapon. The hacktivist group Head Mare compromised servers running TrueConf, a video conferencing platform widely deployed by Russian government agencies and enterprises as an on-premises alternative to Zoom and Teams, and swapped the legitimate client installer for a poisoned build carrying the PhantomCore backdoor. Anyone who downloaded what looked like a routine update got a Trojan horse instead — right in the middle of the workday.
The attack chain starts with an almost frighteningly simple step. A TrueConf server exposes TCP port 4307 by default, with no authentication required. Through that port, the intruder chained two flaws tracked internally as KLCERT-26-057 and KLCERT-26-058: the first allowed a malicious script to run inside the platform's isolated sandbox, and the second enabled an escape from that sandbox into full command execution on the underlying operating system. From there the group escalated privileges to NT AUTHORITY\SYSTEM, the highest level on Windows, and replaced the file \public\js\locale.php with a web shell. The server effectively became a command post: access to the TrueConf database, collection of sensitive environment data, and replacement of the hosted installer with an unsigned, malicious copy.
A second implant, PhantomGraph, consists of two DLLs (SysExcSvc.dll and SysReadSvc.dll) that receive commands through a Microsoft OneDrive account. Observed activity includes dumping LSASS memory to steal credentials, reconnaissance commands such as hostname and whoami, and establishing a reverse SSH tunnel. But the most disturbing detail is the blast radius. An organization does not need to run its own TrueConf server to be hit: an employee who connects to a compromised partner's server to join a meeting and then downloads the installer receives the backdoored package.
The story has deep roots. Supply-chain attacks are one of the most painful chapters of modern security, from the infamous SolarWinds breach to the XZ Utils affair, and more recently the trojanized installers of DAEMON Tools and QuickFox. The pattern is always the same: rather than forcing a thousand doors, the attacker poisons a single water source. If software updates itself and blindly trusts the server that offers the new build, compromising that server means compromising every client at once.
There is a curious, almost counterintuitive movement here. For years companies migrated to the cloud in search of more security and less maintenance. The TrueConf case shows that the on-premises model — a server installed inside the organization itself — does not eliminate supply-chain risk; it merely relocates it. Trust shifts from the cloud vendor to the local team that maintains the box, and any lapse in patching turns the company's own infrastructure into an attack vector against its clients.
Affected versions are TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and all older builds; patches (5.3.9, 5.4.9, 5.5.5) shipped on June 18, 2026, and the activity was detected in July. The advice is straightforward: patch, audit the logs, and distrust any unsigned installer. But the question that lingers is uncomfortable: if a hacktivist crew turned the front door of a meeting tool into a back door, how many other "trusted" updates are quietly circulating out there without anyone looking under the hood?
Sources: TMCnet, Protect Computer, News4Hackers, Hendry Adrian
✓ Independent sources cross-checked and verified before publishing
