Head Mare — PhantomCore & PhantomGraph via Trojanized TrueConf Server

Head Mare — a hacktivist/APT-style threat group — has been exploiting two vulnerabilities in unpatched TrueConf Server videoconferencing software since at least July 2026, per Kaspersky ICS-CERT (published 2026-08-12; Kaspersky's own advisories dated 2026-08-11 and 2026-08-07). KLCERT-26-057 (CVE-2026-72529, CWE-306 missing authentication, CVSS 3.1 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) lets an unauthenticated remote attacker with network access to TCP/4307 — open by default — invoke an undocumented function and run a malicious script inside TrueConf's isolated processing environment. KLCERT-26-058 (CVE-2026-72530, CWE-94 code injection) then lets that script break out of the isolated environment entirely, executing arbitrary code as NT AUTHORITY\SYSTEM on the underlying host.

From SYSTEM, the actor replaces the legitimate …\public\js\locale.php file with a PHP web shell for persistent access, then substitutes the TrueConf Client installer hosted on the compromised server with a trojanized, non-digitally-signed build. Any org member who subsequently connects to that server and accepts the prompted "update" downloads a backdoored installer carrying PhantomCore (a DLL-based backdoor performing system reconnaissance, credential theft including LSASS memory dumping, and C2) and/or PhantomGraph (a two-module backdoor — SysExcSvc.dll / SysReadSvc.dll — that blends its command-and-control with legitimate Microsoft OneDrive traffic). A related Linux backdoor/rootkit variant, deployed against TrueConf Server's Linux build, uses GitHub as its C2 channel and hides via systemd services named to resemble Microsoft OMI and Acronis Cyber Protect components.

Targeting is concentrated on Russian organizations in instrumentation, electronics, transportation, energy, IT, and software development. TrueConf shipped fixed versions 5.3.9 / 5.4.9 / 5.5.5 on 2026-06-18 — roughly seven weeks before Kaspersky's public disclosure — meaning any organization still unpatched at disclosure time had already had a known exploitation window against it.

Highest-value defensive angle: the SysExcSvc/SysReadSvc DLL-drop-plus-service-registration pattern and the PhantomCore DLL masquerading as a Windows CRT redirection stub in the TrueConf client profile are both exact, low-noise behavioral signatures (Q3–Q5 below) that fire regardless of C2 domain rotation, and are strong Custom IOA candidates.

⚠ Patch TrueConf Server to 5.3.9 / 5.4.9 / 5.5.5 (or later) first. Every detection and hardening control in this pack compensates for a vulnerability chain that has had a public fix since 2026-06-18 — closing it removes the entire initial-access vector in one step.

Verification notes (per standing practice — vendor claims are checked, not assumed):

• CVE numbers (CVE-2026-72529 / CVE-2026-72530) appear on the direct Kaspersky ICS-CERT advisory pages and are corroborated independently by The Hacker News — treated as confirmed.
• KLCERT-26-058's advisory page rendered a CVSS numeric base score of 0.0 to the fetch tool alongside a high-severity vector string (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) — almost certainly a page-rendering artifact, not the actual score. This pack cites the corroborated 9.5 figure from The Hacker News and flags the discrepancy rather than silently using either raw number.
• The Hacker News article also covers a separate, unrelated "HelloNet" campaign against ViPNet update infrastructure (HelloInjector/HelloProxy/HelloExecutor/HelloCleaner/HelloBackdoor). That is a different actor and toolset and is explicitly out of scope for this pack — not included in any IOC, query, or hardening control below.
• One GBHackers-reported "hash" for a Linux backdoor variant (4333f52) is only 7 hex characters — not a valid full MD5 — and does not match either confirmed Linux-backdoor MD5 in the Securelist source. Dropped as unverifiable rather than shipped.
• Every atomic indicator shipped in §4/§10 traces to at least one saved source snapshot in HeadMare-PhantomCore-Hunt-sources/ (fetched 2026-08-25); see §18 for the full source list with access dates.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): TrueConf Server process spawns a shell or script interpreter — no legitimate TrueConf workflow does this; strongly indicates KLCERT-26-057/058 exploitation. Falcon: ProcessRollup2.
2. H2 (high): A PhantomCore DLL is written to %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll — an exact-name masquerade of a Windows CRT redirection stub that never legitimately appears in a per-user app-data folder. Falcon: PeFileWritten/NewExecutableWritten.
3. H3 (high): PhantomGraph's SysExcSvc.dll/SysReadSvc.dll pair is written to C:\Windows\System32\inetsrv\ and registered as Windows services. Falcon: file-write + ProcessRollup2 (sc.exe).
4. H4 (high): A trojanized, unsigned TrueConf client installer executes on an endpoint. Falcon: ProcessRollup2 + Authenticode enrichment.
5. H5 (high): Registry persistence is written to the specific CLSID {0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 key observed in this campaign. Falcon: RegGenericValueUpdate/AsepValueUpdate.
6. H6 (medium-high): LSASS-targeting command lines (credential dumping) execute on a host that also shows H1–H3. Falcon: ProcessRollup2.
7. H7 (medium): A non-browser, non-OneDrive-client process resolves/connects to OneDrive or Microsoft Graph domains — the PhantomGraph C2 blending channel. Falcon: DnsRequest + ProcessRollup2 join.
8. H8 (medium): On Linux hosts, an unexpected process (not git/curl/CI tooling) resolves GitHub or raw.githubusercontent.com — the Linux backdoor's C2 channel. Falcon: DnsRequest + ProcessRollup2 join.
9. H9 (medium): A systemd service is enabled under the names omicluster or schedul2-bin, mimicking Microsoft OMI / Acronis Cyber Protect. Falcon: ProcessRollup2 (systemctl).

Attack chain

Gap: steps 1–2 (unauthenticated exploitation inside TrueConf's own sandboxed script environment) have no Falcon EDR visibility — they happen before or below the point where host telemetry is generated. Detection starts at step 3 (sandbox escape to SYSTEM). Close this gap with TrueConf/web-server application logging and network-layer monitoring of port 4307 (see §7 native hunts).

These checks cover attack-chain steps 1–2 and the web-shell drop (step 4) — none of which are visible in standard Falcon endpoint telemetry (see the coverage gap noted in §3).

Every value below traces to a saved source snapshot in HeadMare-PhantomCore-Hunt-sources/ — see §18.

type,value,action,severity,expiration,description,tags
md5,4d27b4eb1c5dbb3d8160f29b8119523e,detect,critical,2027-02-25,Head Mare web shell (locale.php),campaign:HeadMare
md5,748c9f8cb1065000616204935f96207f,detect,critical,2027-02-25,Head Mare trojanized TrueConf installer,campaign:HeadMare
md5,c5a460e4e68a088f6e51b2c6474642ec,detect,critical,2027-02-25,PhantomCore backdoor DLL,campaign:HeadMare
md5,129462164a7d52e9ea8560b60f0412c5,detect,high,2027-02-25,PhantomCore artifact (doc.txt),campaign:HeadMare
md5,ec0bf4a2186a88874e9f26f07cfeb532,detect,high,2027-02-25,PhantomCore artifact (usocacheddata.txt),campaign:HeadMare
md5,b348642146ea34771e5785c5857950f5,detect,high,2027-02-25,PhantomCore variant,campaign:HeadMare
md5,c915cb6c2aeb863ee8479238e1644217,detect,high,2027-02-25,PhantomCore artifact (doc.txt),campaign:HeadMare
md5,0e79996d9483d1e44fea32b0a48c2c19,detect,high,2027-02-25,PhantomCore artifact (doc.txt),campaign:HeadMare
md5,2bb75c20e778eb5c416965bd4d4259b1,detect,high,2027-02-25,PhantomCore variant installer build,campaign:HeadMare
md5,b3a6fee3307f1c26841fd5c603e2b013,detect,high,2027-02-25,PhantomCore artifact (usocacheddata.txt),campaign:HeadMare
md5,8fcc3e4ccbf1725d9989fb464abf3561,detect,high,2027-02-25,PhantomCore artifact (usocacheddata.txt),campaign:HeadMare
md5,489f43be558b2679284ceabed7adc4f3,detect,critical,2027-02-25,PhantomGraph sysexcsvc.dll,campaign:HeadMare
md5,dd1fd2b459b97b7d59375cb8383cd19a,detect,critical,2027-02-25,PhantomGraph sysreadsvc.dll,campaign:HeadMare
md5,0e4541c3153ec5ed01497f19cf4f63d0,detect,high,2027-02-25,PhantomGraph variant sysexcsvc.dll,campaign:HeadMare
md5,12d4e8f5295f2ef7e0f9bfc0f4830939,detect,high,2027-02-25,PhantomGraph variant sysexcsvc.dll,campaign:HeadMare
md5,7f267006cac10f341c356b62fe493527,detect,high,2027-02-25,PhantomGraph variant sysexcsvc.dll,campaign:HeadMare
md5,ee2861d5965e8730708cd1da8a93fa4c,detect,high,2027-02-25,PhantomGraph variant sysexcsvc.dll,campaign:HeadMare
md5,c3a2abe8756910f42582b04a44ea3514,detect,high,2027-02-25,Linux backdoor ELF,campaign:HeadMare
md5,43f435c3c437bc879a2d7d4634f43494,detect,high,2027-02-25,Linux backdoor ELF,campaign:HeadMare
md5,aee9642b45b099cb7f3053b9b680b425,detect,high,2027-02-25,Linux rootkit component,campaign:HeadMare
ipv4,81.177.32.12,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
ipv4,194.87.239.71,detect,high,2027-02-25,Head Mare C2 (SSH observed),campaign:HeadMare
ipv4,194.87.93.153,detect,high,2027-02-25,Head Mare C2 (SSH observed),campaign:HeadMare
ipv4,38.244.205.244,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
ipv4,31.59.102.61,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,penzadogshelter.site,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,trendy-market.site,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,bright-deals.site,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,nova-stream.site,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,rinomobile.ink,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,urbanpixel.store,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,flexish.shop,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,media-hub.today,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,cosmetic-deals.store,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare
domain,vks.gossopka.forum,detect,high,2027-02-25,Head Mare C2,campaign:HeadMare

Web shell:      C:\Program Files\TrueConf Server\httpconf\site\public\js\locale.php
PhantomGraph:   C:\Windows\System32\inetsrv\SysExcSvc.dll
                C:\Windows\System32\inetsrv\SysReadSvc.dll
                C:\Windows\System32\inetsrv\graphi-refresh.dat
                C:\Windows\System32\inetsrv\share\input_*.txt
                C:\Windows\System32\inetsrv\share\output_*.txt
                %TEMP%\cmd_cmd_*.bat
PhantomCore:    %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll
Linux backdoor: /etc/systemd/system/omicluster.service
                /etc/systemd/system/schedul2-bin.service
                /opt/acronis/bin/schedul2-bin
                /omi/bin/omicluster
                /usr/lib64/libzvbi-tchain.so.2
                /var/tmp/cx2
Registry:       HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32
Services:       SysExcSvc, SysReadSvc

Actor:           Head Mare
Backdoors:       PhantomCore (Windows, DLL), PhantomGraph (Windows, SysExcSvc.dll/SysReadSvc.dll),
                 Linux backdoor/rootkit (ELF, GitHub C2)
Vulnerabilities: KLCERT-26-057 / CVE-2026-72529 (CVSS 9.8, missing auth, port 4307/TCP)
                 KLCERT-26-058 / CVE-2026-72530 (CVSS ~9.5, sandbox escape to SYSTEM)
Kaspersky detections:
  Backdoor.PHP.WebShell.abi
  Backdoor.Win64.PhantomCore.dt / HEUR:Backdoor.Win64.PhantomCore.gen / UDS:Backdoor.Win64.PhantomCore.a
  Trojan.Win64.Agent.smgvnc / Trojan.Win64.Agent.smgvnb
  Trojan.Win64.PhantomGraph.gen
  HEUR:Backdoor.Linux.Agent.fb / HEUR:Backdoor.Linux.PhantomHook.a / HEUR:Backdoor.Linux.PhantomReact.a

# TrueConf Server version check (run on each server)
#   Confirm version >= 5.3.9 (5.3.x), >= 5.4.9 (5.4.x), or >= 5.5.5 (5.5.x)
#   Anything below these on the 5.3/5.4/5.5 lines, or any pre-5.3 build, is vulnerable

# Fleet-wide Authenticode check (PowerShell, run against TrueConf client install dirs)
Get-ChildItem -Path "$env:LOCALAPPDATA\TrueConf\Client","C:\Program Files\TrueConf*" `
  -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue |
  Get-AuthenticodeSignature |
  Where-Object { $_.Status -ne 'Valid' } |
  Select-Object Path, Status, StatusMessage

# Port exposure check
#   Confirm TCP/4307 is NOT reachable from untrusted/unauthenticated network segments
#   netstat -ano | findstr 4307   (Windows)   /   ss -tlnp | grep 4307   (Linux)

The entire attack chain depends on one unpatched vulnerability pair. Patching removes the initial-access vector outright; everything else here is defense-in-depth for organizations that cannot patch immediately or want to catch a prior compromise.

Playbook 1 — Patch TrueConf Server

1. Inventory every TrueConf Server instance (Windows and Linux) and record its current version.
   Prerequisites: administrative access to each TrueConf Server host; maintenance window scheduled.
   Reboot required: yes (TrueConf Server service restart; full OS reboot typically not required — confirm in vendor release notes for your build).
   Rollback: snapshot/VM checkpoint before patching; TrueConf supports rollback to the prior installed
   version via its installer if the upgrade fails validation.

2. Download and apply 5.3.9 / 5.4.9 / 5.5.5 (or later) from TrueConf's official distribution channel,
   verifying the installer's own signature before running it.
   Prerequisites: step 1 complete; verified download source.
   Reboot required: yes, TrueConf Server service restart.
   Rollback: restore the pre-patch snapshot/checkpoint if the service fails to start cleanly post-patch.

3. Re-run the Patch/Signature Audit block (§10) against every server to confirm the new version string
   and confirm no residual web-shell/backdoor artifacts remain from a prior compromise.
   Prerequisites: steps 1-2 complete.
   Reboot required: no.
   Rollback: none required — read-only verification step.

Playbook 2 — Restrict TCP/4307 exposure (Windows host firewall example)

1. Identify the legitimate management/client source IP ranges that must reach port 4307.
   Prerequisites: network diagram or firewall-flow log review to avoid breaking legitimate access.
   Reboot required: no.
   Rollback: none required — planning step.

2. Create a scoped inbound firewall rule allowing 4307/TCP only from those ranges, then set the
   default rule for 4307 to Block:
   New-NetFirewallRule -DisplayName "TrueConf-4307-Restrict-Allow" -Direction Inbound -Protocol TCP `
     -LocalPort 4307 -RemoteAddress <trusted-CIDR-list> -Action Allow
   New-NetFirewallRule -DisplayName "TrueConf-4307-Restrict-Block" -Direction Inbound -Protocol TCP `
     -LocalPort 4307 -Action Block
   Prerequisites: administrative access; trusted CIDR list from step 1.
   Reboot required: no.
   Rollback: Remove-NetFirewallRule -DisplayName "TrueConf-4307-Restrict-Allow","TrueConf-4307-Restrict-Block"
   restores the prior (open) state immediately.

3. Validate from an out-of-scope test host that 4307 is unreachable, and from an in-scope host that
   it still connects.
   Prerequisites: step 2 complete.
   Reboot required: no.
   Rollback: none required — verification step.

Playbook 3 — Enable Credential Guard + LSA Protection (RunAsPPL)

1. Confirm hardware/firmware prerequisites (UEFI, Secure Boot, virtualization extensions enabled)
   on target hosts.
   Prerequisites: Windows 10/11 Enterprise or Server 2016+; UEFI Secure Boot enabled; VBS-capable CPU.
   Reboot required: no (assessment only).
   Rollback: none required.

2. Enable LSA Protection via registry:
   New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" `
     -Value 1 -PropertyType DWord -Force
   Prerequisites: step 1 confirmed; pilot ring identified (this can break third-party credential-provider
   plugins that are not PPL-compatible — test before fleet-wide rollout).
   Reboot required: yes.
   Rollback: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -Value 0,
   then reboot.

3. Enable Credential Guard via Group Policy (Computer Configuration > Administrative Templates > System
   > Device Guard > Turn On Virtualization Based Security), or via registry equivalent, then reboot.
   Prerequisites: step 1 confirmed.
   Reboot required: yes.
   Rollback: disable the GPO setting (or set EnableVirtualizationBasedSecurity=0), reboot, then run
   DG_Readiness_Tool.ps1 -Disable if VBS was independently enabled.

4. Confirm via CQL Q6 spot-check that LSASS-targeting commandline attempts on hardened hosts now fail
   (comsvcs.dll MiniDump against a PPL-protected lsass.exe returns access-denied).
   Prerequisites: steps 2-3 complete and rebooted.
   Reboot required: no.
   Rollback: none required — verification step.

Playbook 4 — Egress monitoring for OneDrive/GitHub C2 abuse

1. Deploy Q7 and Q8 (§8) as scheduled searches in detect-only (hunt) mode.
   Prerequisites: DnsRequest and ProcessRollup2 telemetry confirmed flowing (§11 Gate 1).
   Reboot required: no.
   Rollback: disable the scheduled search — no endpoint state is changed by a detect-only query.

2. Baseline 7-14 days of hits, build the FileName/ComputerName exclusion list per each query's
   // TUNING: line, and re-deploy with exclusions applied.
   Prerequisites: step 1 complete; SOC capacity to triage the initial baseline volume.
   Reboot required: no.
   Rollback: revert to the unfiltered query if the exclusion list proves too broad (re-run step 1's version).

3. Where a proxy/firewall supports it, add a monitor-only (not block, to avoid breaking legitimate
   OneDrive/GitHub use) alert rule for the same domain set restricted to non-standard source processes
   or unmanaged hosts outside Falcon coverage.
   Prerequisites: proxy/firewall with per-process or per-application visibility.
   Reboot required: no.
   Rollback: remove the proxy/firewall rule — no endpoint state changed.

⚠ Do not simply patch and move on if a server shows Q1/Q3/Q4/Q9 hits — the sandbox-escape-to-SYSTEM step means the attacker had full host control. Treat any positive hit as a confirmed compromise requiring full IR triage, not just a patch-and-close.

Validation gates: confirm the required telemetry list in §11 is flowing before relying on any query; baseline Q7/Q8/Q10 for 7-14 days before promoting; lab-test Q1/Q5/Q9 positive cases. The two GAP rows (unauthenticated port-4307 exploitation and the web-shell file drop) cannot be closed with Falcon endpoint telemetry alone — they require TrueConf application logging, web-server access logs, and file-integrity monitoring (N1-N3).