TrueConf Was On-Premises. Attackers Turned It Into a Malware Distributor.
TrueConf sells its self-hosted communications platform on a promise that many security-conscious organisations find compelling: keep corporate messaging and video conferencing inside the organisation’s own network.
Attackers turned that deployment model against its users. By chaining two vulnerabilities in unpatched TrueConf Server installations, the Head Mare group gained system-level control, planted backdoors and replaced the legitimate Windows client installer with a trojanised copy. People joining a conference could then receive malware from a server their organisation or business partner already trusted.
The US Cybersecurity and Infrastructure Security Agency added both vulnerabilities to its Known Exploited Vulnerabilities catalogue on 20 August. Federal civilian agencies must remediate them by 3 September. For every other TrueConf operator, the catalogue entry should remove any remaining argument for treating this as a routine patch cycle.
The first flaw opened the server without authentication
CVE-2026-72529 is the entry point. Kaspersky ICS CERT found that an unauthenticated attacker could connect to TrueConf Server over TCP port 4307, call an undocumented critical function and execute an arbitrary script. The port is used by the TrueConf protocol and is open by default in the vendor’s documented configuration.
The vulnerable range covers TrueConf Server 5.3 releases before 5.3.9, 5.4 releases before 5.4.9 and 5.5 releases before 5.5.5, as well as earlier versions. Kaspersky said its analysis showed that all TrueConf Server versions released since 2022 were affected.
The script initially runs in an isolated environment with dangerous libraries unavailable. That boundary did not hold.
The second flaw turned code execution into operating-system control
CVE-2026-72530 is a code-injection and sandbox-escape vulnerability. An attacker who already achieved script execution inside the TrueConf isolated environment could use it to execute commands on the underlying operating system.
On Windows, Kaspersky observed commands running with NT AUTHORITY\SYSTEM privileges. The attackers replaced a TrueConf web file with a web shell and deleted related records from the product’s event logs. They also installed a two-component backdoor using Microsoft OneDrive as a command-and-control channel, with services named SysExcSvc and SysReadSvc providing persistence.
On Linux systems, the researchers found additional backdoor components that intercepted TrueConf network functions and accepted commands through the TrueConf protocol. Another component used GitHub as a command-and-control channel.
The chain matters more than either description in isolation. CVE-2026-72529 removed the need for credentials. CVE-2026-72530 removed the containment that was supposed to limit what an injected script could do.
A trusted download path became the delivery mechanism
After compromising a TrueConf server, Head Mare replaced the 64-bit Windows client installer stored on it. Conference participants were prompted to download what appeared to be a normal TrueConf update. The installer still deployed the legitimate client, but it also placed the PhantomCore backdoor in the user’s local TrueConf directory and configured persistence through a Windows registry key.
That converts a server compromise into a downstream software-distribution incident. The immediate victim is not the complete set of people at risk. Contractors, customers and other guests may have joined meetings on the compromised system and downloaded its installer even if their own organisations never operated TrueConf Server.
It is also why ordinary perimeter scoping can miss the exposure. A company may correctly determine that it has no vulnerable TrueConf server, yet still have employees who installed a client offered by a partner’s server during the affected period.
On-premises control did not remove platform trust
Self-hosting can reduce dependence on a vendor-operated cloud and give an organisation direct control over data location, access policy and network exposure. It also makes the organisation responsible for patching, monitoring and protecting a server that sits inside its own trust boundary.
TrueConf’s architecture made the compromised server more than a conferencing endpoint. It was also a source of client software. That relationship gave attackers a route from one internet-reachable or otherwise accessible server to many user workstations.
The operational lesson is not that self-hosting is inherently unsafe. It is that location is not a substitute for secure design, current software and independent verification of anything a management server distributes to clients.
What TrueConf operators should do now
- Patch to a fixed release. Kaspersky identifies TrueConf Server 5.3.9, 5.4.9 and 5.5.5 as the versions that addressed the exploited vulnerabilities. Organisations should follow the vendor’s current upgrade guidance and move to the newest supported fixed release available for their branch.
- Do not treat patching as proof that no compromise occurred. The flaws were exploited before CISA added them to the catalogue. Preserve evidence and investigate vulnerable systems rather than applying the update and immediately closing the incident.
- Hunt for the published indicators. Kaspersky’s report includes file hashes, service names, file paths, registry keys, domains and IP addresses associated with the campaign. The SysExcSvc and SysReadSvc services, the replaced TrueConf web file and unexpected changes to the Windows client installer deserve immediate attention.
- Review TCP 4307 exposure. Restrict access to the TrueConf protocol to the systems and networks that genuinely require it. Network controls can reduce reachability, but they do not replace the fixed software.
- Verify distributed installers and investigate clients. Compare hosted client packages with known-good vendor copies. Identify users who downloaded an installer from the server during the suspected compromise window, including external participants where records permit.
- Rotate exposed credentials after scoping. If indicators of compromise are found, assume credentials and tokens accessible to a system-level attacker may be exposed. Coordinate password and secret rotation with forensic work so the response does not destroy useful evidence.
The update server is part of the security boundary
The TrueConf campaign is a useful reminder that a product does not need a global cloud update service to create supply-chain consequences. A locally managed server can become the trusted distributor for every user who connects to it.
When that server is exploitable without authentication and its sandbox can be escaped, the attacker gains both privileged execution and a credible delivery channel. The secure-looking download prompt becomes part of the attack.
CISA’s catalogue entry confirms that the two vulnerabilities are not theoretical. Patching is the minimum response. Organisations that operated a vulnerable release, or downloaded a client from someone else’s server, also need to ask whether the trust path was already used against them.
Update, 1 September 2026: the client also trusted code without an integrity check
The server compromise described above explains how a legitimate installer could be replaced. CVE-2026-3502 identifies a complementary client-side failure: affected TrueConf Client releases can download code without an adequate integrity check.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 30 March. It is separate from the server flaws CVE-2026-72529 and CVE-2026-72530, but it reinforces the same supply-chain lesson. A trusted conferencing server and a client that accepts insufficiently verified code can turn one control-plane compromise into downstream endpoint execution.
TrueConf operators should patch both server and client components, verify installer hashes and signing information, inventory clients downloaded during the exposure window and hunt for execution from TrueConf directories followed by persistence or outbound command-and-control traffic.
Primary sources: CISA KEV catalogue, the official CVE record and TrueConf’s current client release guidance.
