Attackers have compromised TrueConf video conferencing servers by exploiting a previously unknown vulnerability. This allows them to run any file they choose on all devices connected to the server.

The vulnerability, identified as CVE-2026-3502, is considered to be of medium severity. It exists because the software’s update process lacks a proper security check, enabling attackers to substitute a legitimate update with a harmful one.

TrueConf is a video conferencing system designed to be hosted on a private server. While a cloud-based option is available, it’s generally intended for use in secure, isolated networks.

According to the company, over 100,000 organizations adopted TrueConf to facilitate remote work during the COVID-19 pandemic. Its user base includes military branches, government departments, energy companies, and air traffic control organizations.

CheckPoint researchers have been monitoring a campaign, dubbed TrueChaos, which has been exploiting CVE-2026-3502 in zero-day attacks against government organizations in Southeast Asia since the start of the year.

“If an attacker takes control of a local TrueConf server, they can replace the expected software update with any program they want, disguising it as the genuine application and sending it to all connected client devices,” CheckPoint says.

“Because the client devices trust the updates coming from the server without verifying them adequately, the malicious file can be delivered and executed as if it were a legitimate TrueConf update.”

The vulnerability affects TrueConf versions 8.1.0 through 8.5.2. Following CheckPoint’s notification, TrueConf released a patch in version 8.5.3 in March 2026.

CheckPoint believes with reasonable certainty that the TrueChaos attacks are linked to a Chinese state-sponsored group, based on their methods, the use of Alibaba Cloud and Tencent for their command and control infrastructure, and the types of victims targeted.

The attacks spread by compromising a central government TrueConf server. This allowed the attackers to deliver malicious files disguised as updates to all connected client devices across numerous government agencies.

The infection process involves DLL sideloading and the installation of surveillance tools (tasklist, tracert), privilege escalation (bypassing User Account Control using iscicpl.exe), and establishing a persistent presence on the compromised systems.

While the researchers couldn’t recover the final malicious program, they observed network traffic pointing to Havoc C2 infrastructure, suggesting that the Havoc implant was likely used.

Havoc is an open-source command and control framework that allows attackers to execute commands, manage processes, manipulate Windows security tokens, run shellcode, and deploy additional malware on infected computers.

The Chinese hacking group ‘Amaranth Dragon‘ has previously used Havoc in similar targeted espionage attacks.

CheckPoint’s report includes indicators of compromise (IoCs) and other signs of infection. Key indicators include the presence of files like poweriso.exe or 7z-x64.dll, and suspicious items such as %AppData%\Roaming\Adobe\update.7z or iscsiexe.dll.