THREAT OPS › Threat News › Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/10125346/trueconf-head-mare-ics-cert-featured-image-990x400.jpg" width="990" /></p><h2 id="overview-of-the-attack">Overview of the attack</h2> <p>In July 2026, Kaspersky experts detected a new attack by the Head
MITRE ATT&CK techniques
Indicators of compromise
- 4d27b4eb1c5dbb3d8160f29b8119523emd5
- 748c9f8cb1065000616204935f96207fmd5
- c5a460e4e68a088f6e51b2c6474642ecmd5
- 129462164a7d52e9ea8560b60f0412c5md5
- ec0bf4a2186a88874e9f26f07cfeb532md5
- b348642146ea34771e5785c5857950f5md5
- c915cb6c2aeb863ee8479238e1644217md5
- 0e79996d9483d1e44fea32b0a48c2c19md5
- 2bb75c20e778eb5c416965bd4d4259b1md5
- b3a6fee3307f1c26841fd5c603e2b013md5
- 8fcc3e4ccbf1725d9989fb464abf3561md5
- 489f43be558b2679284ceabed7adc4f3md5
- dd1fd2b459b97b7d59375cb8383cd19amd5
- 0e4541c3153ec5ed01497f19cf4f63d0md5
- 12d4e8f5295f2ef7e0f9bfc0f4830939md5
- 7f267006cac10f341c356b62fe493527md5
- ee2861d5965e8730708cd1da8a93fa4cmd5
- c3a2abe8756910f42582b04a44ea3514md5
- 43f435c3c437bc879a2d7d4634f43494md5
- aee9642b45b099cb7f3053b9b680b425md5
- https://trueconf.com/blog/update/trueconf-server-security-updates-june-2026url
- https://trueconf.com/downloads/windows.html#security-checkurl
- https://www.kaspersky.com/enterprise-security/endpoint-detection-response-edr?icid=gl_sl_post-kedr-expert_sm-team_29dc1130f3f612f2url
- https://tip.kaspersky.com/landscape/hunts/edr/faab5325-a0a1-48ce-a28e-82c7dded1372url
- https://tip.kaspersky.com/landscape/hunts/edr/e2e5e7b6-31c5-4d86-8813-f9a94a7d80f3url
- https://tip.kaspersky.com/landscape/hunts/edr/80a28546-5b80-4819-b6a3-eb909afa85b1url
- https://www.kaspersky.com/enterprise-security/managed-detection-and-response?icid=gl_sl_mdr-lnk_sm-team_195a10e9872df951url
- https://www.kaspersky.com/enterprise-security/unified-monitoring-and-analysis-platform?icid=gl_sl_siem-inpost-link_sm-team_c6da27b0f60ba483url
- https://opentip.kaspersky.com/4d27b4eb1c5dbb3d8160f29b8119523e/results?icid=gl_sl_tr-post-opentip_sm-team_6ae178bfc737ba37&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/748c9f8cb1065000616204935f96207f/results?icid=gl_sl_tr-post-opentip_sm-team_e9958393849b4815&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/c5a460e4e68a088f6e51b2c6474642ec/results?icid=gl_sl_tr-post-opentip_sm-team_8b27283fc40a1643&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/129462164a7d52e9ea8560b60f0412c5/results?icid=gl_sl_tr-post-opentip_sm-team_15dffa8e982a9888&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/ec0bf4a2186a88874e9f26f07cfeb532/results?icid=gl_sl_tr-post-opentip_sm-team_901253dcd593311a&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/b348642146ea34771e5785c5857950f5/results?icid=gl_sl_tr-post-opentip_sm-team_93654c1d2815e437&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/c915cb6c2aeb863ee8479238e1644217/results?icid=gl_sl_tr-post-opentip_sm-team_74ac72e7bb7a5ddc&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/0e79996d9483d1e44fea32b0a48c2c19/results?icid=gl_sl_tr-post-opentip_sm-team_eb86ce793ad3b6c5&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/2bb75c20e778eb5c416965bd4d4259b1/results?icid=gl_sl_tr-post-opentip_sm-team_8e4b160454b81b50&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/b3a6fee3307f1c26841fd5c603e2b013/results?icid=gl_sl_tr-post-opentip_sm-team_e671bbd064c6f817&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/8fcc3e4ccbf1725d9989fb464abf3561/results?icid=gl_sl_tr-post-opentip_sm-team_a9b186af22f36d6b&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/489f43be558b2679284ceabed7adc4f3/results?icid=gl_sl_tr-post-opentip_sm-team_0257f62afff52218&utm_source=SL&utm_medium=SL&utm_campaign=SLurl