TrueConf Server Flaws Used to Deliver PhantomCore Malware

TL;DR. Attackers exploited vulnerabilities in TrueConf Server software to replace legitimate client installers with PhantomCore backdoor malware, enabling broader system compromise. - The exploit allows cross-domain privilege escalation by substituting valid installation files with malicious payloads. - Identity exposure was key, providing active attack paths for threat actors to sever breach routes. - The delivered PhantomCore payload provides full control over compromised systems, including data exfiltration capabilities.

• TrueConf Server vulnerabilities allowed malicious installer substitution.
• PhantomCore backdoor malware was delivered through compromised installers.
• Cross-domain privilege escalation enabled the attack.
• Identity exposure facilitated initial access and attack paths.

Back to QLANKR News