PhantomCore Exploits Unpatched TrueConf Flaws to Breach Russian Networks Since Sept 2025
Since Sept 2025, PhantomCore exploited critical TrueConf Server vulnerabilities (BDU:2025-10116, CVSS 9.8), breaching Russian networks. Patches were available but unapplied.
TL;DR
A pro-Ukrainian hacktivist group named PhantomCore has exploited unpatched critical vulnerabilities in TrueConf Server since mid-September 2025, leading to widespread network breaches in Russian organizations. The group developed its own exploit chain to bypass authentication and execute commands, despite patches becoming available in late August 2025.
Context
PhantomCore, a politically and financially motivated threat actor, has actively targeted Russian organizations since 2022. This group, also known as Fairy Trickster, focuses on data theft and network disruption, sometimes deploying ransomware. Their operations are known for stealth and continuous tool evolution.
Key Facts
Since mid-September 2025, PhantomCore has leveraged a chain of three previously unpatched vulnerabilities in TrueConf Server, a video conferencing platform. The most critical flaw, BDU:2025-10116, is a command injection vulnerability with a CVSS (Common Vulnerability Scoring System) score of 9.8. This high-severity rating indicates the flaw enables attackers to execute arbitrary operating system commands on affected servers.
The exploit chain begins with BDU:2025-10114 and BDU:2025-10115, which allow attackers to access administrative endpoints and read arbitrary files without authentication. Despite TrueConf releasing patches for these issues on August 27, 2025, PhantomCore independently reproduced and exploited the vulnerability chain weeks later. Their actions have resulted in numerous successful intrusions across Russian networks.
What It Means
Upon compromising a TrueConf Server, PhantomCore uses it as an initial access point to move laterally across internal networks. The group deploys various tools for reconnaissance, defense evasion, and credential harvesting. These include PHP-based web shells—malicious scripts that allow remote command execution and file uploads—and custom reverse shell clients like PhantomPxPigeon.
Attackers also utilize tools such as ADRecon for network discovery and Veeam-Get-Creds, a modified PowerShell script, to recover passwords from Veeam Backup & Replication software. For persistent access, some intrusions have involved creating a rogue administrative user named "TrueConf2" with administrative privileges on compromised servers. The group establishes communication channels using tunneling utilities, masking their activities within the victim's network.
Mitigations
Organizations operating TrueConf Server must immediately apply all available security updates, particularly those released on August 27, 2025, addressing BDU:2025-10114, BDU:2025-10115, and BDU:2025-10116. Network segmentation for critical servers can limit lateral movement post-compromise. Implement robust endpoint detection and response (EDR) solutions to identify anomalous processes and unauthorized user creations, such as the "TrueConf2" account. Regular security audits and vulnerability scanning remain essential practices.
The continued activity of groups like PhantomCore highlights the critical need for timely patching and comprehensive security strategies. Defenders should monitor for new attack methodologies and adapt defenses accordingly.
Continue reading
More in this thread
UNC6692 Uses Email Bombing and Fake Teams IT Scam to Deploy SNOW Malware
Peter Olaleru
Itron Confirms Mid‑April Cyber Intrusion That Reached Internal Systems
Peter Olaleru
UNC6692 Exploits Default Microsoft Teams Settings to Target Senior Staff with SNOW Malware Suite
Peter Olaleru
Conversation
Reader notes
Loading comments...