TrueConf Exploitation Turns Meeting Servers Into Malware Distribution

CISA added CVE-2026-72529 and CVE-2026-72530 in TrueConf Server to its Known Exploited Vulnerabilities catalog on August 20. Kaspersky ICS CERT says attackers associated with the Head Mare activity combined the flaws against Russian organizations: an unauthenticated party with network access to TCP port 4307 could invoke an undocumented function to run a script, then escape the script's isolated environment and execute code on the host. The observed intrusion installed web shells and backdoors and replaced a server-hosted Windows client installer with a package that also delivered PhantomCore malware.

TrueConf released fixed 5.3.9, 5.4.9, and 5.5.5 builds on June 18. Operators should update every older server, but an upgrade alone is not incident recovery where the service was reachable or evidence supports exploitation. Preserve evidence, compare server files and client packages with trusted artifacts, investigate the published indicators, rotate credentials exposed to the host, and identify participants who downloaded installers from the server. Covered federal agencies face an August 23 due date for CVE-2026-72529 and September 3 for CVE-2026-72530; other organizations should treat KEV and the documented campaign as urgent risk evidence, not as proof that their own server was compromised.

Kaspersky assigns CVE-2026-72529 to a missing-authentication flaw in a critical TrueConf Server function. A remote, unauthorized attacker who can reach port 4307/TCP can call an undocumented function and execute an arbitrary script. The first condition is therefore reachability to a product protocol, not access to the administration website or possession of a meeting account. A firewall rule that protects only the web console does not establish that the vulnerable path is private.

The script initially runs inside an isolated environment without hazardous libraries such as operating-system or file I/O modules. CVE-2026-72530 is a separate code-injection weakness that lets a specially crafted script break out of that isolation and execute arbitrary code on the host. Kaspersky describes the second step as high complexity because successful exploitation may require several attempts. High complexity did not prevent observed use, and the first flaw supplies the script execution position needed for the chain.

CISA's KEV entries confirm exploitation at the catalog's evidence threshold. They do not independently publish victim names, exploit volume, every initial network path, or a complete attribution assessment. Kaspersky links the observed PhantomCore activity to Head Mare, while CISA lists ransomware use as unknown. Defenders can rely on the vulnerability chain and observed artifacts without expanding the public evidence into a broader campaign claim.

Kaspersky's incident report describes more than command execution on one collaboration server. On Windows, the attackers replaced a TrueConf web file with a PHP web shell, created backdoor components, and established services named SysExcSvc and SysReadSvc. The report also says the exploit path could delete related records from TrueConf event logs. On Linux systems, researchers found backdoors that intercepted TrueConf network functions, with one component using GitHub as a command channel.

The most consequential pivot was the client package hosted by the compromised server. The attackers replaced the x64 Windows installer in the server's ClientInstFiles directory. Conference participants who were prompted to download the client could receive an installer that installed the expected TrueConf application and also placed PhantomCore malware under the user's local application-data directory. That creates a second population for incident scoping: users of the server, not only its administrators.

This does not prove every client connected to a vulnerable server received malware, and it should not be confused with every TrueConf update mechanism issue ever reported. The confirmed fact is narrower: Kaspersky observed an attacker with control of an organization-owned server altering a package distributed by that server. Administrators need package identity and download evidence from their own environment before declaring downstream compromise or clearing participant endpoints.

TrueConf published 5.3.9, 5.4.9, and 5.5.5 on June 18 and urged immediate installation. The vendor says the free and corporate editions receive the update without a support purchase. Updating within the same 5.3, 5.4, or 5.5 line does not normally require re-registration, while operators on 5.2 or earlier are directed to contact TrueConf support. The vendor also recommends reviewing its upgrade guide and creating a backup before installation.

Kaspersky's affected ranges include every version before 5.3, 5.3.x before 5.3.9, 5.4.x before 5.4.9, and 5.5.x before 5.5.5 on Windows and Linux. Verify the running service after maintenance rather than relying on the downloaded filename or a completed installer. Appliances restored from snapshots, disaster-recovery nodes, test servers, and automation images can reintroduce an affected build after the primary system appears fixed.

CISA set different federal due dates: August 23 for the missing-authentication flaw and September 3 for the isolation breakout. Covered agencies must follow the applicable BOD 26-04 process. The dates are not a recommendation to leave half of the observed chain exposed. Both vulnerabilities are fixed by the same supported server releases, and the documented campaign makes a complete update plus evidence review the coherent operational unit.

Start with a defensible exposure window. Record the installed and running TrueConf version, operating system, port 4307 bindings, firewall and load-balancer paths, public addresses, service account, installation directories, backups, and the dates each build was active. Preserve volatile process and network information, service definitions, scheduled tasks, authentication and administrative records, TrueConf event data, web-server logs, endpoint telemetry, DNS history, and available cloud-service audit records before restarts or cleanup rotate them.

Compare files against trusted vendor artifacts or a known-good deployment. Kaspersky publishes hashes, paths, service names, registry keys, domains, addresses, and YARA rules for the observed campaign. Useful checks include the altered locale.php path, SysExcSvc and SysReadSvc, unexpected services on Linux, the published local persistence key, unusual OneDrive or GitHub traffic from the server, and client installers whose hashes or signatures differ from the authorized package. Indicators age and can be changed, so a negative match is not conclusive.

Build a participant-download list from server access logs, help-desk records, meeting invitations, browser download history, endpoint telemetry, and software inventory where retention permits. Prioritize Windows systems that downloaded or executed a TrueConf installer from an affected server during the exposure window. Preserve the suspect installer if policy allows, isolate supported infections, and investigate child processes, persistence, credentials, and lateral activity. Do not ask users to reinstall from the same server until its integrity is re-established.

If the server was reachable but no compromise evidence is found, update promptly, validate the running version, scan against current detections, and document the evidence sources and their retention limits. If indicators or unexplained changes support execution, treat the host as compromised. A clean package install over an attacker-controlled server cannot prove that a web shell, service, rootkit, altered database record, or credential theft has been removed.

Rebuild from trusted media or a verified pre-compromise baseline using a fixed TrueConf release. Restore only content and configuration that have been reviewed, regenerate deployment artifacts, and compare every client installer offered by the new server with the vendor-authorized package. Rotate operating-system, database, directory, service, API, backup, and administration credentials that were present or usable on the host. Sequence rotations so the rebuilt service does not immediately receive old secrets.

Downstream response should follow evidence. An endpoint that executed a confirmed malicious installer needs isolation, investigation, credential containment, and usually rebuild. A participant who merely joined through a browser has a different scope. Communicate the server, time window, installer filename, trusted replacement source, and required user action clearly. Avoid broad claims that meeting content or every participant device was exposed when the public research does not establish those outcomes.

Organizations often self-host communications software to keep messages, identity connections, recordings, and meeting traffic under local control. That choice also makes the server a privileged application platform and, in this case, a software distribution point. Network location is not a sufficient control when a protocol port is reachable from broad partner, remote-access, or Internet paths and the service can hand executable packages to users.

Restrict port 4307 to the smallest required network set, monitor it separately from the web interface, and place the server in a segment that limits access to directory services, management systems, and general user networks. Run the service with the least practical operating-system authority, centralize security logs outside the host, alert on changes to web roots and installer directories, and baseline services, scheduled tasks, package hashes, and outbound destinations.

Finally, separate application availability from update trust. Publish client downloads through an independently protected repository, verify vendor signatures and hashes before promotion, and have endpoints enforce signed-package policy. Maintain a meeting fallback that does not require participants to install software from a server under investigation. A collaboration server can protect communications only while its operating system, distribution channel, and recovery process remain trustworthy.