TrueConf CVE-2026-72529: One Open Port, Every Employee Gets Malware

On-premises video conferencing was supposed to be the safe choice. You kept the meetings off someone else's cloud, ran the server in your own rack, and told the auditors the data never left the building. Head Mare just demonstrated the failure mode of that decision: a single unauthenticated TCP port turns your on-prem conferencing server into a malware distribution channel that pushes trojanized clients to every employee who dials in.

On 20 August 2026, CISA added CVE-2026-72529 and CVE-2026-72530 to the Known Exploited Vulnerabilities catalog, with a three-day federal patch deadline for the first and two weeks for the second. The bugs were patched by the vendor back on 18 June 2026. The gap between "patch shipped" and "actively exploited, KEV-listed" is nine weeks — nine weeks in which the exploit chain was public enough for Kaspersky ICS CERT to catch it in the wild and reconstruct it end to end.

What CVE-2026-72529 and CVE-2026-72530 actually do

Two bugs, chained, take an attacker from the network to NT AUTHORITY\SYSTEM on the host without a single credential.

	CVE-2026-72529	CVE-2026-72530
Class	Unauthenticated RCE via undocumented function	Sandbox / isolated-environment escape
CVSS	9.3	9.5
Kaspersky ID	KLCERT-26-057	KLCERT-26-058
Effect	Run arbitrary script inside the server's isolated interpreter	Break out of isolation, execute on the host as SYSTEM

The entry point is TCP port 4307, which the TrueConf documentation says is open by default. No login prompt sits in front of it. An attacker with network reach calls an undocumented server function, transmits a script, and executes it inside TrueConf's sandbox (CVE-2026-72529). That sandbox was the only thing standing between the interpreter and the operating system — and CVE-2026-72530 removes it, dropping the attacker onto the host with full privileges.

This is the same structural pattern we keep writing about: the "authentication" everyone assumed was there is a default-open management port, and the isolation everyone trusted is one bug deep. Reaching the port is the login.

The part that makes this different: the server ships the malware

Most RCE stories end at "attacker has root on the box." Head Mare's kill chain is interesting because of what they did with root — and it is the reason this belongs in every threat model that includes internal software distribution.

After escaping to SYSTEM, according to Kaspersky's Securelist analysis, the operators:

• Planted a web shell by replacing the legitimate …\public\js\locale.php with a malicious PHP file.
• Enumerated infrastructure and pulled database access.
• Replaced the legitimate TrueConf client installers hosted on the server with trojanized versions.

That last step is the payload. When an employee downloads the conferencing client from the company's own TrueConf server — the sanctioned, internal, "trusted" source — they get a working TrueConf client plus PhantomCore, sideloaded as %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll, masquerading as a Universal CRT DLL. Persistence is a COM hijack via HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32.

"But the installer came from our server." That sentence is exactly the assumption the attack monetizes. The malicious distributions Kaspersky recovered were not validly digitally signed — the one tell that would have stopped a careful user, and the one check almost nobody does before running an internal tool.

One compromised host fans out to the entire meeting roster. A conferencing server is a near-perfect distribution point: everybody in the org touches it, the client is expected to auto-update, and nobody treats an internal download as untrusted input.

Post-exploitation: OneDrive, GitHub, and split commands to dodge EDR

PhantomCore is a loader for a modular framework. Alongside it, Head Mare deployed PhantomGraph, two services (SysExcSvc.dll, SysReadSvc.dll) installed via Base64-encoded PowerShell that use Microsoft OneDrive as the command-and-control channel — one module receives tasks, the other reads them, runs them through batch files, and writes results back. Kaspersky notes the operators "deliberately split this malicious command into two components to make it harder to detect using EDR tools." Other variants beacon over GitHub and open SSH reverse tunnels to attacker infrastructure. Observed hands-on-keyboard activity included LSASS memory dumping and standard whoami / hostname reconnaissance.

Read that C2 list again: OneDrive, GitHub, SSH. All three are allow-listed egress on essentially every corporate network. Signature-based EDR and NDR that key on known-bad domains see nothing — the destinations are Microsoft and GitHub. This is the blind spot the second half of this article is about.

Remediation

Head Mare's current targeting is Russian industrial and IT organizations, but the vulnerabilities are universal, the chain is now public, and CISA has KEV-listed both. Treat any internet-reachable TrueConf Server as urgent.

1. Am I affected?

Check the server build. Vulnerable: all TrueConf Server releases since 2022, specifically 5.3.x up to and including 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and earlier. Then check exposure — port 4307 should never face the internet:

# From outside the perimeter — is the management port reachable?
nmap -Pn -p 4307 <trueconf_server_ip>
# On the host — what is listening and who is talking to it?
ss -tnp | grep ':4307'

2. Patch — exact fixed versions

Upgrade to TrueConf Server 5.3.9, 5.4.9, or 5.5.5 (released 18 June 2026) or later on your branch. These are the vendor-fixed builds for both CVE-2026-72529 and CVE-2026-72530. Patching is necessary but not sufficient — if the server was reachable before you patched, assume the installers were already swapped (see step 4).

3. Can't patch this hour? — compensating controls

• Firewall port 4307/TCP to management subnets only. It has no business being internet-facing, patched or not.
• Put the conferencing server behind a VPN or reverse proxy that terminates authentication before TrueConf's own logic.
• Re-publish client installers from a known-good source and verify their digital signatures before anyone downloads.

4. Hunt for compromise (ATT&CK-mapped)

Patching a box that was already rooted just locks the attacker's own tools inside with you. Hunt on both the server and every endpoint that installed the client:

• Server — web shell (T1505.003): a modified …\public\js\locale.php; Kaspersky IOC MD5 4d27b4eb1c5dbb3d8160f29b8119523e.
• Endpoints — trojanized client (T1195.002 / T1574.001): the sideloaded DLL %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll; installer MD5 748c9f8cb1065000616204935f96207f (trueconf_windows_update.exe).
• Persistence (T1546.015): the COM-hijack key HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32.
• PhantomGraph services (T1543.003): SysExcSvc / SysReadSvc, files under C:\Windows\System32\inetsrv\ (SysExcSvc.dll, SysReadSvc.dll, graphi-refresh.dat, share\input_*.txt, share\output_*.txt).
• C2 (T1567.002 / T1071): outbound to OneDrive and GitHub from server processes; SSH to 194.87.239[.]71, 194.87.93[.]153; hosts including 81.177.32[.]12, 38.244.205[.]244, 31.59.102[.]61; domains penzadogshelter[.]site, nova-stream[.]site, vks.gossopka[.]forum and others in the Securelist IOC set.
• Credential access (T1003.001): LSASS dumping on any host that ran the trojanized client.

5. Eradicate + verify

Rebuild the TrueConf host from a clean image — a SYSTEM-level web shell plus database access means partial cleanup is not defensible. Reimage or fully remediate every endpoint that installed a client between the exposure window and your fix. Rotate every credential the server could reach, service accounts first, and rotate any secret PhantomGraph's LSASS dumps may have captured. Confirm clean after patching, then re-issue signed installers.

Where Zero Hunt fits: validate the box before an APT does

Three things had to be true for this to work: the server was internet-reachable on 4307, it was running a build older than the June fix, and nobody re-validated it after the patch shipped. The annual pentest that "covered the conferencing server last November" would have missed all three.

Zero Hunt's 10-agent generative pentest is built for exactly this gap. The Recon agent finds the TrueConf server the moment it appears on the perimeter — change-triggered campaigns kick off a full assessment within the hour of a new asset showing up, not at the next quarterly window. The Exploit agent then writes a per-target chain against it: a local LLM generates the exploit for the version and configuration in front of it, rather than replaying a static ExploitDB module, so the finding is "this specific server is rootable via 4307," backtested in the AI Gym against the Vulhub/CVE corpus before it ever runs, and ECDSA-signed into the evidence chain for the auditor. A patched-but-still-exposed server does not get a clean bill of health because it is patched — it gets tested.

And because Head Mare's C2 hides inside OneDrive, GitHub, and SSH — destinations no domain blocklist will ever flag — the network is the only surface where the trojanized client shows its hand. Zero Hunt's AI Traffic Analysis runs a deep-learning model with four inference heads (suspicious traffic, malware classification, attack-type identification, application fingerprinting) on the appliance GPU at line rate, learning what your conferencing hosts normally talk to. A TrueConf server that suddenly opens SSH reverse tunnels, or an endpoint whose "CRT DLL" starts staging files to a personal OneDrive, is a behavioral anomaly while it happens — not a signature match in tomorrow's SIEM digest. When the malware ships from a source you trust and beacons to a cloud you allow, behavior is the only thing left that tells the truth.