TrueConf client installers trojanized with backdoors

The Head Mare hacktivist group has compromised TrueConf video conferencing servers to distribute malicious client installers containing backdoors. The attack targets organizations running unpatched TrueConf server software, replacing legitimate installer files with trojanized versions that deploy persistent access tools when executed by end users.

What happened

Security researchers identified that Head Mare gained access to TrueConf server infrastructure by exploiting known vulnerabilities that remained unpatched. Once inside, the attackers replaced the official client installer packages with modified versions containing backdoor functionality. These trojanized installers maintain the original software's appearance and functionality while silently establishing remote access capabilities for the threat actors.

The source did not specify how many organizations downloaded the malicious installers or whether any successful compromises occurred beyond the initial distribution. TrueConf has not publicly commented on the incident or released guidance for affected customers. The timing of the breach remains unclear, with no specific dates provided for when the server vulnerabilities were exploited or when the trojanized installers became available for download.

What we don't know yet

Several key details remain undisclosed. The number of potentially affected organizations is unknown, as is whether any post-installation exploitation has been observed. The specific vulnerabilities exploited in TrueConf's server software have not been identified, nor has the company issued patches or mitigation advice. The duration of the compromise and whether other TrueConf products or services were affected also remain unclear.