They did not steal the meetings. They replaced the client everyone downloads to join them.
CVE-2026-72529 and CVE-2026-72530 — two actively exploited flaws in TrueConf Server. CISA added both to the KEV catalog on August 20 with a three-day patch deadline. Kaspersky traced the campaign back to at least July.
WHAT ACTUALLY HAPPENED
CVE-2026-72529 lets an unauthenticated attacker execute code on port 4307. No login, no credentials, no user interaction.
CVE-2026-72530 breaks out of TrueConf's sandbox and runs code directly on the host.
Chained, they hand over the server. The Head Mare group used them to drop a webshell, map the victim's infrastructure, take privileged access to the TrueConf Server database — and then replace the legitimate client installers hosted on that server with backdoored versions.
Every employee who downloaded the conferencing client from their own company's server after that installed the malware themselves.
Fixed in 5.3.9, 5.4.9 and 5.5.5.
WHY THIS IS A SUPPLY CHAIN ATTACK, NOT AN RCE
Compromising the server is the setup. Distribution is the attack.
An internal download server carries something no phishing email ever gets: institutional trust. The URL is on your intranet, the file is the one IT told people to use, and endpoint controls are frequently configured to allow it.
That turns one unauthenticated RCE into signed-off, self-service deployment of a backdoor across the whole workforce — with no user error to blame afterwards.
It also means the incident does not end when you patch the server. Every installer pulled from it during the exposure window is a live compromise sitting on an endpoint.
Ask where your users get their software from, and whether that box is patched to the same standard as the software it distributes.
WHAT TO DO NOW
PATCH TO 5.3.9 / 5.4.9 / 5.5.5 — exploitation predates the KEV listing by more than a month, so speed here is not optional.
BLOCK PORT 4307 FROM UNTRUSTED NETWORKS — the pre-auth entry point should never be internet-reachable.
VERIFY EVERY DISTRIBUTED INSTALLER — hash the binaries on the server against vendor originals and hunt endpoints for clients installed during the exposure window.
INVENTORY YOUR INTERNAL DOWNLOAD SERVERS — anything that ships executables to staff is a supply chain component and needs to be treated as tier-one infrastructure.
The most efficient malware delivery channel in your organisation is the one your users already trust.
Which internal servers in your estate hand executables to employees — and when were they last patched?