TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks

A high‑severity zero-day (CVE-2026-3502, CVSS 7.8) in TrueConf's update mechanism was exploited in the wild by the TrueChaos campaign to distribute tampered updates from compromised on‑premises TrueConf servers, enabling arbitrary code execution via DLL sideloading; the campaign targeted Southeast Asian government entities, delivered a DLL backdoor and likely the Havoc C2, used FTP and cloud infrastructure (including Alibaba/Tencent), and has been patched in TrueConf Windows client version 8.5.3.