TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

A threat actor known as Head Mare is exploiting security flaws in unpatched TrueConf servers to target Russian companies. The targeted sectors include instrumentation, electronics, transport, energy, IT, and software development. The attacks were detected by Russian cybersecurity vendor Kaspersky in July 2026. The threat actor is using a vulnerability chain to carry out the attacks, which involve replacing client installers with PhantomCore.