PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks

PhantomCore, a pro-Ukrainian hacktivist group, has been exploiting a chain of three TrueConf Server vulnerabilities (CVSS scores 7.5, 7.5, and 9.8) to breach Russian networks since September 2025.

• •The attack chain bypasses authentication via insufficient access control, arbitrary file reading, and command injection vulnerabilities to execute remote commands on TrueConf servers.
• •PhantomCore developed exploits for vulnerabilities with no prior public exploits, demonstrating significant research capabilities despite patches being released on August 27, 2025.
• •Successful compromises enable lateral movement using custom tools (PhantomPxPigeon, PhantomSscp, MacTunnelRat) combined with public tools (Velociraptor, DumpIt, MemProcFS) for reconnaissance, credential harvesting, and persistence.
• •The group establishes multiple communication channels including PHP-based web shells, SSH tunnels, and SOCKS proxies to maintain access and control compromised hosts.