PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks

Published:

27 april 2026 om 11:54:00

Alert date:

27 april 2026 om 13:02:18

Source:

thehackernews.com

Enterprise Applications, Ransomware & Malware, Zero-Day Vulnerabilities

Pro-Ukrainian hacktivist group PhantomCore has been actively targeting servers running TrueConf video conferencing software in Russia since September 2025. The threat actors are leveraging an exploit chain comprising three vulnerabilities to execute remote commands on susceptible systems. This campaign represents active exploitation of video conferencing infrastructure in a geopolitically sensitive context, with the attacks being attributed by Positive Technologies researchers.

Technical details

PhantomCore exploited a chain of three TrueConf Server vulnerabilities: insufficient access control allowing unauthenticated requests to admin endpoints, arbitrary file read capability, and command injection for executing arbitrary OS commands. The attack chain begins with compromising TrueConf servers, then uses them as springboards for lateral movement. Tools deployed include PHP-based web shells for remote command execution, PhantomPxPigeon backdoor disguised as legitimate TrueConf client, tunneling utilities (PhantomSscp, MacTunnelRat, PhantomProxyLite), reconnaissance tools (ADRecon), credential harvesting tools (DumpIt, MemProcFS, modified Veeam-Get-Creds), and SOCKS proxies (microsocks, rsocx, tsocks). The group creates rogue administrative accounts named 'TrueConf2' and maintains persistence through reverse SSH tunnels.

Mitigation steps:

Apply security patches released by TrueConf on August 27, 2025 to address the three vulnerabilities (BDU:2025-10114, BDU:2025-10115, BDU-2025-10116). Monitor for unauthorized administrative accounts named 'TrueConf2'. Implement network monitoring to detect unusual TrueConf server communications and lateral movement patterns. Watch for deployment of PHP web shells and reverse SSH tunnels. Monitor for reconnaissance activities using tools like ADRecon and credential harvesting attempts targeting Veeam backup systems. Implement endpoint detection for the mentioned malware families and maintain updated threat intelligence on PhantomCore TTPs.

Affected products:

TrueConf Server
TrueConf video conferencing software
Veeam Backup & Replication software

Related links:

Related CVE's:

BDU:2025-10114

BDU:2025-10115

BDU-2025-10116

Related threat actors:

IOC's:

TrueConf2 (rogue user account), PhantomPxPigeon backdoor, PhantomSscp DLL, MacTunnelRat PowerShell script, PhantomProxyLite PowerShell script, CapDoor backdoor, EchoGather trojan, SoullessRAT, AquilaRAT, stardebug[.]app (fake website), alphafly-drones[.]com (fake website)

This article was created with the assistance of AI technology by Perceptive.