Ethical Hacking News
Hackers have exploited a critical zero-day vulnerability in TrueConf, a popular video conferencing platform used by numerous organizations across the globe. The attack, dubbed "TrueChaos," leverages a flaw in the update mechanism of the software to deliver malicious updates that can be executed on all connected endpoints. As security experts continue to monitor the situation and work towards a patch or a fix, users are being urged to remain vigilant and ensure that they implement adequate measures to protect themselves from potential future attacks.
Hackers exploited a zero-day vulnerability in TrueConf video conferencing platform, dubbed "TrueChaos." The attack leverages a critical flaw in the update mechanism to deliver malicious updates. The vulnerability (CVE-2026-3502) was rated with a medium severity score and stems from a missing integrity check in the software's update process. Targeted government entities in Southeast Asia linked to Chinese-nexus threat actor group Amaranth Dragon. The attack uses tactics like DLL sideloading, reconnaissance tools, and privilege escalation. The malicious software used is likely an open-source framework called Havoc, previously attributed to the Amaranth Dragon threat group. Users are urged to implement adequate measures to protect themselves from potential future attacks.
Hackers have successfully exploited a zero-day vulnerability in TrueConf, a popular video conferencing platform used by numerous organizations across the globe. The attack, dubbed "TrueChaos," has left security experts on high alert as it leverages a critical flaw in the update mechanism of the software to deliver malicious updates that can be executed on all connected endpoints.
The vulnerability, identified as CVE-2026-3502, was rated with a medium severity score by the relevant authorities. It stems from a missing integrity check in the software's update process, which allows attackers to replace legitimate updates with malicious variants. This exploit can have far-reaching implications for organizations that rely on TrueConf for their remote online business activities.
According to CheckPoint researchers, the "TrueChaos" operation targets government entities in Southeast Asia and has been linked to a Chinese-nexus threat actor group known as the Amaranth Dragon. The attackers use a combination of tactics, techniques, and procedures (TTPs) to execute arbitrary files on all connected endpoints, including DLL sideloading, the deployment of reconnaissance tools, privilege escalation via UAC bypass, and the establishment of persistence.
The researchers noted that network traffic pointed to Havoc C2 infrastructure, indicating that the malicious software used by the attackers is likely an open-source framework capable of executing commands, managing processes, manipulating Windows tokens, executing shellcode, and deploying additional payloads on compromised systems. This framework, known as Havoc, has previously been used in attacks attributed to the Amaranth Dragon threat group.
The true extent of the damage caused by this attack remains unknown, but it is clear that numerous organizations rely on TrueConf for their remote communication needs. As security experts continue to monitor the situation and work towards a patch or a fix, users are being urged to remain vigilant and ensure that they implement adequate measures to protect themselves from potential future attacks.
In related news, the attack comes as a wake-up call for organizations that have transitioned to TrueConf during the COVID-19 pandemic. Over 100,000 organizations have opted for TrueConf in recent times, including military forces, government agencies, oil and gas corporations, and air traffic management companies. The vulnerability highlighted in this attack underscores the importance of staying up-to-date with the latest security patches and ensuring that all updates are thoroughly validated before being executed.
As the threat landscape continues to evolve, it is essential for organizations to stay informed about emerging vulnerabilities and take proactive steps to protect themselves from potential attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Hacking-the-High-Tech-Gathering-TrueConf-Zero-Day-Exploitation-and-its-Far-Reaching-Implications-ehn.shtml
https://www.bleepingcomputer.com/news/security/hackers-exploit-trueconf-zero-day-to-push-malicious-software-updates/
https://thehackernews.com/2026/03/trueconf-zero-day-exploited-in-attacks.html
https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/
https://nvd.nist.gov/vuln/detail/CVE-2026-3502
https://www.cvedetails.com/cve/CVE-2026-3502/
https://research.checkpoint.com/2026/amaranth-dragon-weaponizes-cve-2025-8088-for-targeted-espionage/
https://hivepro.com/threat-advisory/amaranth-dragon-low-noise-high-impact-espionage-in-southeast-asia/
https://securelist.com/tomiris-new-tools/118143/
https://www.picussecurity.com/resource/blog/lazarus-group-apt38-explained-timeline-ttps-and-major-attacks
Published: Wed Apr 1 16:58:30 2026 by llama3.2 3B Q4_K_M
