US mandates emergency patches for Russian-made TrueConf vulnerabilities
Federal agencies given until September 10 to fix critical video conferencing flaws
1Critical vulnerabilities requiring immediate patching
The US Cybersecurity Agency (CISA) has classified two flaws in Russian-developed TrueConf video conferencing system as 'actively exploited'. Vulnerabilities CVE-2026-72529 and CVE-2026-72530 allow remote code execution on servers. Federal agencies must patch these by September 10. Kaspersky reports Ukrainian-aligned Head Mare hacker group is using these to target Russian companies across transport, energy, and tech sectors.
2Exploitation mechanism
The first vulnerability enables malicious command execution through TCP port 4307, which TrueConf leaves open by default. The second flaw allows escaping the isolated environment to gain full server control. Kaspersky observed hackers deploying web shells and gaining admin access to TrueConf databases. Attackers then replaced legitimate client installers with trojanized versions containing PhantomCore backdoor.
3Supply chain infection risk
Experts warn the risk extends beyond direct TrueConf server operators to all employees connecting to compromised systems. Trojanized installers downloaded from hacked supplier servers could spread PhantomCore malware across organizational networks. TrueConf's international clientele reportedly includes Switzerland's DOJ and Istanbul Airport, though current adoption rates remain unclear. Most customer success stories predate 2022.
4Russia-focused attacks
The only documented attacks so far involve pro-Ukrainian Head Mare group targeting Russian companies. TrueConf's Moscow headquarters and predominantly Russian customer base have made it a cyber conflict frontline. CISA hasn't disclosed whether US organizations face exploitation risks. The software's on-premise deployment capability creates additional concerns for sensitive data handling.
5Patches and updates
TrueConf released fixes in versions 5.3.9, 5.4.9 and 5.5.5 on June 18, warning unpatched systems remain vulnerable to internet-based attacks. However, not all TrueConf servers are internet-facing - those on internal networks require additional access vectors for exploitation. Kaspersky confirmed affected versions have been in use since 2022.
6Enterprise security implications
Unlike cloud-based Zoom or Teams, TrueConf offers data-localization through on-premise solutions, driving adoption particularly in Russia. These vulnerabilities now make it attractive for hackers targeting critical infrastructure. While clear data on Russian government usage is lacking, experts suspect widespread deployment in strategic sectors.
7Industry security lessons
This incident underscores critical software supply chain risks. Kaspersky's findings demonstrate how default open ports and delayed patching create attack surfaces. During geopolitical tensions, security audits should intensify for software originating from conflict zones. The TrueConf case offers a stark example of how cyber warfare dynamics intersect with physical conflicts.
8Recommended actions
CISA's September 10 patch deadline should serve as benchmark for all critical infrastructure operators. TrueConf users must immediately update versions, review network monitoring systems, and audit TCP port 4307 traffic. Verifying third-party suppliers' TrueConf usage can mitigate supply chain risks. Long-term, geopolitical factors will reshape software vendor selection criteria across industries.