Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants
2026-08-12T20:51:46Z•fa899d7fd35715a0fb2b69c9cd6ad53849ad8fd90faccea1b802fd00229a9930
APTAiTMC2Central-AsiaDNS-tunnelingESXiGenieLockerGoogle-Apps-ScriptMFA-bypassMirage-KittenNightLedgerOctLurkPhantomCorePhantomGraphProject-CAV3RNSilkLurkTrueConfUNC1549Windows-malwarecloud-platform-abusecyber-espionageexploitationphishingransomwareunpatched-server
What happened
Kaspersky Securelist RSS collection covering active cyber-threat activity in August 2026, including Head Mare exploitation of unpatched TrueConf servers to deliver PhantomCore and PhantomGraph, Project CAV3RN C2 using Google Apps Script and DNS routing, cloud-hosted adversary-in-the-middle phishing bypassing MFA, espionage backdoors targeting Central Asia and the Middle East/Africa, and GenieLocker ransomware targeting Windows, Linux, and ESXi. The feed also includes broader quarterly threat statistics and defensive analysis.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- fa899d7fd35715a0fb2b69c9cd6ad53849ad8fd90faccea1b802fd00229a9930
- Enrichment time
- 2026-08-12T20:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.