TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks

This article covers the exploitation of a zero-day vulnerability (CVE-2026-3502) in TrueConf video conferencing software targeting Southeast Asian government networks in a campaign called TrueChaos.

• •CVE-2026-3502 (CVSS 7.8) is a lack of integrity check in TrueConf's update mechanism, allowing attackers who control the on-premises server to distribute tampered updates to all connected clients.
• •The attack chain uses DLL side-loading to launch a DLL backdoor ('7z-x64.dll'), which performs reconnaissance, establishes persistence, and fetches additional payloads ('iscsiexe.dll') from an FTP server.
• •The campaign is attributed with moderate confidence to a Chinese-nexus threat actor, based on use of DLL side-loading, Alibaba Cloud and Tencent C2 infrastructure, and overlap with ShadowPad activity.
• •The Havoc open-source C2 framework is assessed to be the likely final-stage payload deployed on compromised endpoints.