InfoSecBulletin Cybersecurity for mankind
A critical security flaw in the TrueConf video call software has been used in real attacks. It is a zero-day threat in a campaign aimed at government organizations in Southeast Asia called TrueChaos.
The flaw is traced as CVE-2026-3502 . There is no check for integrity when getting application update code. This lets an attacker send a fake update that can run unwanted code. It has been fixed in the TrueConf Windows client from version 8.5.3, which came out earlier this month.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
“The flaw stems from the abuse of TrueConf’s updater validation mechanism, allowing an attacker who controls the on-premises TrueConf server to distribute and execute arbitrary files across all connected endpoints,” Check Point said in a report.
The TrueChaos campaign has used this flaw in the update system to possibly send the open-source Havoc command-and-control (C2) tool to weak points. This action is believed, with moderate confidence, to be linked to a threat actor from China.
Attacks using the flaw were first reported by the cybersecurity firm Checkpoint at the start of 2026. Attacker took advantage of the trust users have in the update system to send a bad installer that uses DLL side-loading to start a DLL backdoor.
TrueConf Zero-Day
The DLL implant (“7z-x64.dll”) has also been observed performing hands-on-keyboard actions to conduct reconnaissance, set up persistence, and retrieve additional payloads (“iscsiexe.dll”) from an FTP server (“47.237.15[.]197”). The primary objective of “iscsiexe.dll” is to ensure the execution of a benign binary (“poweriso.exe”) that’s dropped to sideload the backdoor.
The exact malware used in the last stage of the attack is not known, but it’s believed with high confidence that the aim is to install the Havoc implant.
The report shows that TrueChaos is likely to be connected to a Chinese threat group based on their tactics. They use methods like DLL side-loading, Alibaba Cloud, and Tencent for their command and control network. Also, the same victim was attacked around the same time by ShadowPad, a complex backdoor often used by Chinese hackers.
The use of Havoc has also been linked to another Chinese group called Amaranth-Dragon. They are targeting government and law enforcement agencies in Southeast Asia in 2025.
“The exploitation of CVE-2026-3502 did not require the attacker to compromise each endpoint individually,” Check Point said. “Instead, the attacker abused the trusted relationship between a central on-premises TrueConf server and its clients.
By replacing a legitimate update with a malicious one, they turned the product’s normal update flow into a malware distribution channel across multiple connected government networks.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) put CVE-2026-3502 on its list of known security issues. They require federal agencies to fix it by April 16, 2026.
