Kaspersky researchers uncovered a campaign by the Head Mare APT group exploiting vulnerabilities in an unpatched TrueConf server. The attackers use malicious TrueConf software installers to deliver PhantomCore and PhantomGraph backdoors to video conference participants. This targeted attack highlights the risks associated with unpatched collaboration software and the sophistication of APT groups.