Surprise: your local video server just became a malware delivery service. Attackers have been sneaking into unpatched TrueConf servers, swapping the real client installers for naughty copies that quietly install backdoors when teammates join a meeting. Not cozy.

What happened

Researchers discovered a campaign where a hacktivist group exploited flaws in TrueConf servers to run code inside the app and then break out to the operating system. From there they escalated privileges to NT AUTHORITY\\SYSTEM, dropped a web shell for persistence, and replaced the legitimate updater so users would receive a malicious package instead of a clean client.

The attacker-served installer is not digitally signed, so it’s an easy giveaway if you’re looking — but many organizations happily click through updates without checking signatures. The implanted backdoor families observed include PhantomCore (bundled into the trojanized client) and a second implant called PhantomGraph, which uses DLL components to receive commands (the activity included dumping the LSASS process memory to steal credentials and opening reverse SSH tunnels).

How the intrusion works and what to do about it

Quick technical tour: the attackers used an open TCP port (4307 by default) and leveraged two vulnerabilities that let them execute scripts inside the app and then escape the sandbox to run OS-level commands. Once on the system they replaced a server-side file with a web shell to keep access and to swap the official client installer for a compromised one. They also used cloud-backed command channels in one campaign to send and receive commands.

  • Indicators: unexpected connections to port 4307, non-signed TrueConf installer files, unknown web shells or modified server-side PHP/JS files, DLLs like those used by PhantomGraph, and LSASS memory dumps in logs.
  • Observed attacker moves: reconnaissance commands (hostname, whoami), privilege escalation to SYSTEM, reverse SSH tunnels, credential theft, and persistent web shells.
  • Initial access methods: phishing, exploiting public-facing web apps, and third-party/contractor access.

TrueConf versions affected include 5.3.x before 5.3.9, 5.4.x before 5.4.9, and 5.5.x before 5.5.5. Vendor patches were released on June 18 — if you haven’t updated, that should be your first stop.

Practical checklist (do these now unless you enjoy panic):

  • Update TrueConf servers to the fixed versions immediately.
  • Verify digital signatures on client installers before deploying updates.
  • Scan servers for web shells and unexpected changes to server-side files.
  • Hunt for LSASS dumps, new reverse tunnels, and unusual outbound connections (including cloud storage C2 patterns).
  • Close or monitor unused ports (watch TCP 4307), and apply network segmentation for conferencing infrastructure.
  • Review third-party and contractor access — rotate credentials and enforce least privilege.
  • Educate users to treat updates from unfamiliar servers with suspicion.

If you run TrueConf on-premises, treat your server like a small crown jewel: patch it, sign installers, and log like your audit report depends on it (because it does). And hey — keep an eye out for any trojanized installers; they’re the kind of surprise nobody wants at a team meeting.