TrueConf became a malware channel: Head Mare replaced trusted installers

The Head Mare group compromised self-hosted TrueConf videoconferencing servers and replaced the legitimate client installer with a backdoored build. A user downloaded the file from their own organisation’s server, a source naturally trusted more than an external link. That trust turned one edge-system intrusion into a supply-chain attack against multiple workstations.

The observed campaign affected organisations in transportation, science and education. There is no basis for treating every TrueConf installation as compromised. Each self-hosted operator should nevertheless verify its version, the integrity of distributed files and download history instead of stopping after patch installation.

Two routes led to the same backdoor

The first part of the campaign had been active since at least December 2025 and was detected in February 2026. It used videoconference invitations. After following a link, the victim was offered a client installer. A previously unknown backdoor named PhantomPxPigeon ran alongside the expected software.

In the second part, attackers did not need a lookalike brand domain. They took over genuine, locally managed TrueConf servers and replaced the client package available from them. A Kaspersky ICS CERT report confirms the file replacement and the absence of a valid digital signature on detected malicious distributions.

The exact entry path into those specific servers was not confirmed. Researchers considered exploitation of BDU:2025-10116 plausible; the vendor released a fix for that vulnerability in August 2025. The distinction matters: installer replacement is an observed fact, while attributing initial access to this one flaw remains a hypothesis.

Why a signature is stronger than trusting a URL

TLS authenticates a connection to a server but does not prove that its administrator is serving the vendor’s original file. A checksum hosted on the same compromised server also provides no independent evidence. A code signature binds a binary to the publisher’s key and can be verified by the operating system before execution.

The malicious packages found in the campaign lacked a valid signature. An organisation that blocks unsigned installers and deploys software from a central repository after independent verification could have interrupted this chain even after the conferencing server was compromised.

Responding to suspected replacement

1. Upgrade TrueConf Server to a current supported release. The vendor identified 5.5.1, 5.4.6 and 5.3.7 as the initial corrected lines, but operators should use the newest available maintenance build.
2. Isolate a suspected server before analysis and preserve disk images, reverse-proxy logs, authentication logs and its distribution directory.
3. Collect hashes for every installer served during the investigation period. Verify signatures away from the compromised host against a trusted vendor source.
4. Determine which endpoints downloaded or executed each hash by correlating browser, proxy, EDR and software-deployment telemetry.
5. On potentially infected endpoints, hunt for installer child processes, unusual scheduled tasks, new services and outbound traffic beginning after installation.
6. Rotate secrets available on the TrueConf server and credentials used by administrators from potentially infected devices.
7. Rebuild the distribution channel from a clean image. Restoring the legitimate installer alone does not remove persistent attacker access to the server.
8. Enforce signed-code allowlisting and maintain an independent hash manifest in a system that the TrueConf administrator cannot modify.

Facts and Breachroad analysis

Kaspersky confirms PhantomPxPigeon, compromised servers, replaced packages and missing valid signatures. Exploitation of BDU:2025-10116 remains likely but unconfirmed. The independent manifest and per-download hash correlation are Breachroad recommendations designed to preserve evidence when the source server is untrustworthy.

Incident response training teaches teams to separate the initial vulnerability from the full scope of compromise. An infrastructure security assessment can examine edge servers, installer repositories, signatures and the ability to reconstruct a distribution path.