PhantomCore Exploits TrueConf Vulnerabilities in Russian Networks

Pro-Ukrainian hacktivist group PhantomCore has been actively targeting Russian servers running TrueConf video conferencing software since September 2025. The Hacker News, citing a report by Positive Technologies, indicates that PhantomCore is leveraging an exploit chain comprising three vulnerabilities. These flaws allow for remote command execution on susceptible TrueConf installations.

This isn’t a spray-and-pray operation. PhantomCore is clearly focused on specific targets, likely government or critical infrastructure within Russia, given TrueConf’s common use in those sectors. The use of a multi-vulnerability exploit chain demonstrates a higher level of sophistication than typical hacktivist activity, suggesting dedicated resources for vulnerability research or access to advanced exploits.

For defenders, this highlights the critical risk of neglecting patching for internal-facing, collaboration-focused applications. While the target here is Russia, the tactics are universal. Attackers consistently pivot from easily exploitable collaboration tools to deeper network access. This is a stark reminder that even seemingly innocuous software can be a significant attack vector if not rigorously secured and updated.