TrueConf

Researchers Expose GPON Optical Network Eavesdropping via Modified ONU Devices at DEF CON

At DEF CON 34, two researchers demonstrated how inexpensive hardware modifications allow interception of downstream traffic in GPON fiber networks shared among multiple subscribers. The passive optical design means all clients connected to the same splitter receive identical data streams, with separation handled only at the ONU level through 12-bit GEM port identifiers. By acquiring Realtek RTL960x-based SFP modules and systematically bypassing built-in restrictions on GEM port reassignment, VLAN tagging, switch forwarding, and checksum validation, the team achieved access to traffic intended for up to 128 neighboring users. Exposed data includes DNS queries that can reveal occupancy patterns, unencrypted SIP voice traffic, and in some cases traffic from nearby cellular base stations. The researchers also identified exploitable vulnerabilities in the VSOL G100S OLT device that could grant root-level control and compromise provider routers. Additional coverage in the same Kaspersky report examined Head Mare's compromise of TrueConf servers, EvilFontTool font-based evasion, an OpenAI presentation on an accidental AI attack against Hugging Face, and the SCTPhantom Linux kernel flaw present for 18 years.

Head Mare Hackers Exploit TrueConf Servers to Distribute PhantomCore and PhantomGraph Backdoors

Russian organizations have been targeted in a new campaign by the Head Mare group, which compromises unpatched TrueConf servers to deliver backdoors. Attackers chain vulnerabilities KLCERT-26-057 and KLCERT-26-058 to execute arbitrary code with maximum privileges on affected servers. They then replace a server file with a web shell to explore the victim's infrastructure, access the TrueConf database, and substitute the client installer. Victims are tricked via social engineering into downloading the malicious client during video conferences without any suspicious emails. The campaign affects TrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier releases. Kaspersky researchers recommend immediate updates to patched versions 5.3.9, 5.4.9, and 5.5.5 released on 18 June 2026. The threat extends beyond direct TrueConf users, as any employee invited to a compromised server can inadvertently install the backdoor.