PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks
Since September 2025, servers using TrueConf video conferencing software in Russia have been the target of attacks by a pro-Ukrainian hacktivist organization known as PhantomCore.
According to a Positive Technologies assessment, the threat actors are using an exploit chain made up of three vulnerabilities to remotely execute commands on servers that are vulnerable.
According to researchers Daniil Grigoryan and Georgy Khandozhko, attackers from PhantomCore were able to carry out their research and replicate vulnerabilities despite the lack of exploits for this chain of vulnerability in public access. This resulted in numerous instances of its operation in Russian organizations.
PhantomCore, also known as Fairy Trickster, Head Mare, Rainbow Hyena, and UNG0901, is the moniker given ...