PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks

Positive Technologies attributes active exploitation of a three‑vulnerability chain in TrueConf Server (including a CVSS 9.8 command injection) to the PhantomCore hacktivist group; attackers bypassed authentication, deployed PHP web shells and a range of bespoke and public tools to perform lateral movement, credential harvesting, reconnaissance, and proxying, and have also used phishing lures and archive attachments in follow‑on campaigns. The report also profiles related clusters (e.g., CapFIX, multiple "Werewolf" variants) and describes toolsets and operational TTPs observed against Russian organizations.