How TrueConf Got Trojanized by Head Mare

Your trusted video app might be secretly hacking your servers. The tool you use every day could've opened the door for a full network intrusion. A threat group called Head Mare has pulled off a slick supply chain hack. They've trojanized the TrueConf installer to deliver two nasty payloads: PhantomCore and PhantomGraph. It runs a normal install so you don't notice a thing. But under the hood, it's silently dropping web shells and grabbing full local SYSTEM control. Honestly, it's a pretty clever trick. Here's how this attack chain works and what you need to look for. First, the hack relies on that trojanized TrueConf installer. While you're looking at a normal setup wizard, it's secretly deploying the PhantomCore backdoor. Once active, PhantomCore steals metadata, runs shell commands, and gets a permanent foothold. Second, they launch PhantomGraph. That's the secondary backdoor. It uses web shells to run commands with SYSTEM privileges. By hiding in normal web directories and running via local services, it bypasses regular security filters. That lets them sneak around your network. Third, look for indicators of compromise. Search for weird network traffic from TrueConf. Check your web servers for unexpected web shells. And watch out for cmd or PowerShell running under your video app. Check your TrueConf clients immediately. Audit system privileges and scan your logs for these flags. Subscribe to stay ahead of these threats and keep your network secure.