[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftHlfoRQKUhoJATfO_XwYsxK12KP5Q6F9_XXZApaDr6w":3},{"article":4,"iocs":52,"watch_terms":74,"solutions":75,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"0bb07bc8-1da3-4a1f-8c38-e487cb2eef4c","Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants","head-mare-apt-is-exploiting-vulnerabilities-in-an-unpatched-trueconf-server-to-d-5533e3","Kaspersky experts have discovered malicious TrueConf software installers. The Head Mare APT group uses them to deliver the PhantomCore and PhantomGraph backdoors to target systems by exploiting vulnerabilities in an unpatched TrueConf server.","The Head Mare APT group is exploiting two new vulnerabilities (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf video conferencing servers to deliver the PhantomCore and PhantomGraph backdoors. Attackers gain system-level privileges, replace client installers with infected versions, and use Microsoft OneDrive for C2 communication.","Head Mare APT exploits TrueConf server flaws to deploy PhantomCore and PhantomGraph backdoors.","https:\u002F\u002Fsecurelist.com\u002Ftr\u002Fhead-mare-targets-trueconf-server-with-phantomcore\u002F120988\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F08\u002F10125346\u002Ftrueconf-head-mare-ics-cert-featured-image.jpg","2026-08-11T12:00:55+00:00","2026-08-11T14:00:06.654515+00:00",9,[17,20,23,26],{"name":18,"type":19},"Head Mare APT","threat_actor",{"name":21,"type":22},"TrueConf Server","product",{"name":24,"type":25},"Microsoft","vendor",{"name":27,"type":28},"OneDrive","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":29,"icon":31,"name":32,"slug":33},null,"Nation-state","nation-state",[35,37,42,47],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,60,63,66,69,72],{"type":54,"value":55,"context":56},"mitre_attack","T1059.001","PowerShell command used for persistence",{"type":54,"value":58,"context":59},"T1547.001","Registry key used for persistence",{"type":54,"value":61,"context":62},"T1071.004","OneDrive used for C2 communication",{"type":54,"value":64,"context":65},"T1190","Exploitation of vulnerabilities in TrueConf server",{"type":54,"value":67,"context":68},"T1047","Web shell used for remote control",{"type":46,"value":70,"context":71},"PhantomCore","Backdoor malware delivered to target systems",{"type":46,"value":73,"context":71},"PhantomGraph",[24,21],{"controls":76,"vendors":163},[77,106,134],{"slug":78,"name":79,"problem":80,"products":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":107,"name":108,"problem":109,"products":110},"patch-management","Automated patch management","Known holes get closed in days, not months.",[111,118,126],{"vendor_slug":112,"vendor_name":24,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":135,"name":136,"problem":137,"products":138},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[139,147,155],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[],{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":181},"unpatched-trueconf-servers-used-to-backdoor-video-conference-participants","Unpatched TrueConf Servers Used to Backdoor Video Conference Participants","The Head Mare APT group exploited two unpatched vulnerabilities in TrueConf video conferencing servers to gain system-level privileges and replace legitimate client installers with trojanized versions containing the PhantomCore and PhantomGraph backdoors. This is a classic software supply chain attack facilitated by poor patch hygiene — leaving a public-facing server unpatched created the initial foothold. The use of Microsoft OneDrive for command-and-control (C2) communications demonstrates how attackers abuse trusted cloud services to blend malicious traffic with legitimate network activity. This incident matters because every user who downloaded the compromised installer became an unwitting victim, multiplying the blast radius far beyond the initial server compromise.",[169,170,171,172,173,174,175,176,177,178,179,180],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SA-12: Supply Chain Protection","NIST SI-7: Software, Firmware, and Information Integrity","NIST SC-7: Boundary Protection (Network Segmentation)","MITRE ATT&CK T1195.002: Supply Chain Compromise – Software Supply Chain","MITRE ATT&CK T1102: Web Service (C2 via OneDrive)","ITIL Change Management: Emergency Change Procedures for Critical Patches","GDPR Article 32: Security of Processing (obligation to patch known vulnerabilities)",{}]