THE content discusses a cyber attack attributed to the Head Mare group targeting TrueConf video conferencing servers, discovered by Kaspersky in July 2026. The attackers exploited two previously unknown vulnerabilities to gain control over unpatched servers. They distributed a trojanized client to install the PhantomCore backdoor, marking a shift in Head Mare's classification from hacktivists to an advanced persistent threat (APT).
The attack poses risks to Russian organizations across various sectors and can affect any user connecting to the compromised servers. Kaspersky advises immediate updates to patched software versions and warns of further threats from additional backdoors like PhantomGraph. Organizations are urged to verify digital signatures for client installers and monitor for unauthorized access.