[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyMM6k1Adv72FAL_5c9rxEYsBb1liszeAhmXLg44P4Sk":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"31526b03-bb0f-42f6-98a5-0f0eb8635cee","Hackers breach TrueConf to trojanize client installers with backdoors","hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors-efca8e","The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors. [...]","The Head Mare hacktivist group is exploiting vulnerabilities in unpatched TrueConf servers to distribute backdoored client installers. This allows them to deploy PhantomCore and PhantomGraph malware, collect sensitive information, and exfiltrate credentials. The attacks primarily target Russian organizations across various sectors.","Hackers trojanize TrueConf installers with backdoors via unpatched server vulnerabilities.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-breach-trueconf-to-trojanize-client-installers-with-backdoors\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F19\u002Fbox.jpg","2026-08-08T14:16:23+00:00","2026-08-08T16:00:15.835641+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Head Mare","threat_actor",{"name":21,"type":22},"TrueConf","product",{"name":24,"type":25},"Kaspersky","vendor",{"name":27,"type":25},"CheckPoint Research",{"name":29,"type":30},"Operation True Chaos","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62],{"type":56,"value":57,"context":58},"ip","4307","TCP port used by Head Mare to connect to TrueConf servers without authentication.",{"type":48,"value":60,"context":61},"PhantomCore","Backdoor deployed by Head Mare via trojanized TrueConf client installers.",{"type":48,"value":63,"context":64},"PhantomGraph","Backdoor deployed by Head Mare using DLL files and OneDrive for command and control.",[24,27,21],{"controls":67,"vendors":153},[68,96,124],{"slug":69,"name":70,"problem":71,"products":72},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[73,81,88],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":69,"product_name":85,"url":86,"description":87},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,109,116],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":97,"product_name":113,"url":114,"description":115},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":125,"name":126,"problem":127,"products":128},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[],{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":169},"unpatched-trueconf-servers-used-to-deliver-backdoored-installers","Unpatched TrueConf Servers Used to Deliver Backdoored Installers","The Head Mare hacktivist group exploited known vulnerabilities in unpatched TrueConf servers to tamper with client software installers, effectively turning a trusted distribution mechanism into a malware delivery pipeline. This is a classic supply-chain-style attack where the integrity of software distribution is compromised at the server level rather than the source code level. Once users downloaded and executed the trojanized installers, attackers deployed PhantomCore and PhantomGraph malware to harvest credentials and exfiltrate sensitive data. The attack highlights the severe downstream risk of neglecting server-side patch management — unpatched infrastructure doesn't just expose itself, it can weaponize the trust users place in legitimate software. Organizations must treat software distribution servers as critical assets requiring the highest patch priority.",[159,160,161,162,163,164,165,166,167,168],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-7: Software, Firmware, and Information Integrity","NIST SA-12: Supply Chain Protection","NIST RA-5: Vulnerability Monitoring and Scanning","ITIL Change Management: Emergency Change Procedures","MITRE ATT&CK T1195.002: Compromise Software Supply Chain","MITRE ATT&CK T1027: Obfuscated Files or Information",{}]