TrueConf, a Russian-made video-conferencing platform widely deployed as an on-premises alternative to Zoom and Microsoft Teams inside enterprise and government networks, has had its own distribution channel turned against its users. Kaspersky researchers report that a group tracked as Head Mare found its way into unpatched TrueConf servers through an authentication-free entry point — a management port the software leaves open by default — and used that access to run arbitrary code with the highest available privileges. From there, instead of just stealing data from the server itself, the attackers replaced the legitimate client installer with a trojanized one, turning every device that downloaded an "official" update into a fresh infection.
The swapped installers carried two backdoors, PhantomCore and PhantomGraph. PhantomGraph is built from two DLL files that take their instructions from an attacker-controlled Microsoft OneDrive account — the malware checks the account for new commands, runs them locally, and posts the results back — letting the operators skip the command-and-control infrastructure that usually gives defenders something to flag. Once inside, Kaspersky observed the attackers dumping the memory of Windows' LSASS process to harvest saved credentials, running basic reconnaissance, opening reverse SSH tunnels, and dropping a web shell for persistence. TrueConf has since shipped patched builds (5.3.9, 5.4.9, 5.5.5) that close the server-side entry point, but the trojanized installers were already circulating for a period before every server had updated.
What this means for your business
Few readers of this desk run TrueConf itself, but the mechanism is the part worth remembering: nobody had to click a phishing link, because the malicious file was the "official" download coming straight from a vendor's own server. Any business running self-hosted collaboration, remote-access, or update-distribution software should treat that server as part of its attack surface, not just the client software it hands out — patch it on the vendor's own schedule, and if it has no reason to sit on the open internet, put it behind a VPN or IP allowlist rather than leaving default ports exposed. Where it's practical, verify a new installer's checksum or digital signature against the vendor's published value before rolling it out fleet-wide, especially for on-premises enterprise tools where "the update server can be trusted" is usually an unexamined assumption. If your organisation runs TrueConf specifically, treat this as urgent: move to a patched build now and review recent installer downloads for anything that looks out of place.