Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants

The Head Mare APT group exploited two unpatched vulnerabilities in TrueConf video conferencing servers to gain system-level privileges and replace legitimate client installers with trojanized versions containing the PhantomCore and PhantomGraph backdoors. This is a classic software supply chain attack facilitated by poor patch hygiene — leaving a public-facing server unpatched created the initial foothold. The use of Microsoft OneDrive for command-and-control (C2) communications demonstrates how attackers abuse trusted cloud services to blend malicious traffic with legitimate network activity. This incident matters because every user who downloaded the compromised installer became an unwitting victim, multiplying the blast radius far beyond the initial server compromise.