Head Mare hacktivists inject PhantomCore backdoor via trojanized TrueConf installers
Hacktivist group Head Mare exploited unpatched TrueConf video‑conferencing servers, swapping legitimate client installers for malicious versions that embed the PhantomCore and PhantomGraph backdoors. The malware grants system‑level access, can dump LSASS credentials, and spreads to any user who downloads the trojanized installer, endangering Russian enterprises and any organization connecting to compromised TrueConf servers.