# TrueConf Zero-Day Used in TrueChaos Campaign Against Southeast Asian Governments


## The Threat


A critical vulnerability in TrueConf's video conferencing software has been actively exploited in targeted attacks against government networks throughout Southeast Asia in a campaign researchers are tracking as TrueChaos. The flaw, tracked as CVE-2026-3502, stems from inadequate integrity verification during the application's update process, allowing threat actors to inject malicious code directly into legitimate software updates.


The attack chain is particularly insidious: when TrueConf clients check for updates, the application fails to properly validate the cryptographic signature or integrity of downloaded update packages. An attacker positioned to intercept network traffic—or one who has compromised update distribution infrastructure—can inject malware into the update stream. Victims receive what appears to be a legitimate software update and execute it with the same privileges as the TrueConf application itself, potentially granting attackers high-level access to enterprise systems.


This represents a worst-case scenario for software supply chain security. Rather than compromising the vendor's infrastructure directly, threat actors are abusing a fundamental flaw in how the client validates updates. For government agencies already using TrueConf for secure communications, the implications are severe: an attacker could establish persistent backdoor access, exfiltrate classified communications, or pivot deeper into critical infrastructure networks.


## Severity and Impact


| Attribute | Details |

|---|---|

| CVE ID | CVE-2026-3502 |

| CVSS Score | 7.8 (High) |

| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |

| Attack Vector | Local |

| Attack Complexity | Low |

| Authentication Required | None |

| User Interaction | Required |

| CWE | CWE-347 (Improper Verification of Cryptographic Signature) |

| Exploited in Wild | Yes (TrueChaos campaign) |


The CVSS 7.8 rating reflects the vulnerability's practical exploitability and severe impact. While the attack vector is technically "local" (requiring presence on the network or ability to intercept updates), the low attack complexity and absence of authentication requirements make this highly dangerous in enterprise environments where TrueConf may be used on shared networks or where network traffic inspection tools are limited.


## Affected Products


The following TrueConf products and versions are affected by CVE-2026-3502:


  • TrueConf Client (Windows, macOS, Linux)
  • - Versions 8.0 through 8.3.x before patched releases

    - Version 9.0 before 9.0.1

    - Version 9.1 before 9.1.2


  • TrueConf Server
  • - Versions 7.2 through 8.2.x (update delivery component vulnerable)


  • TrueConf Room System
  • - All versions through 7.5


  • TrueConf WebRTC Client
  • - Browser-based versions affected if connecting to vulnerable server infrastructure


    Organizations should verify their installed versions immediately, as the TrueChaos campaign specifically targets government entities that may have deployed older, less-maintained instances of TrueConf.


    ## Mitigations


    Immediate Actions:


    1. Patch Immediately — Apply vendor updates as soon as they become available. TrueConf has released patched versions that implement cryptographic signature verification on all update packages. Check the vendor advisory for specific version numbers and deployment guidance.


    2. Network Segmentation — Restrict TrueConf client and server access to designated network segments. Limit the systems that can reach TrueConf update servers, and implement network access controls to prevent lateral movement if a client is compromised.


    3. Update Traffic Inspection — Monitor and validate TrueConf update downloads at the network boundary:

    - Use proxy/firewall rules to inspect TrueConf update traffic

    - Validate update package hashes against TrueConf's published cryptographic checksums

    - Block updates from non-official sources


    4. Application Hardening:

    - Disable automatic updates temporarily if patching cannot be completed immediately, and manually verify updates before installation

    - Run TrueConf clients with minimal required privileges (avoid running as administrator where possible)

    - Disable features not in use (screen sharing, file transfer, recording) to reduce attack surface


    5. Threat Detection — Deploy endpoint detection and response (EDR) tools to monitor TrueConf process behavior:

    - Alert on unexpected child processes spawned by TrueConf

    - Monitor for unusual network connections initiated by the application

    - Flag suspicious file writes or registry modifications


    6. Network Monitoring — Implement network detection tools to identify:

    - Attempts to intercept TrueConf update traffic

    - Suspicious TLS certificate validation failures for update servers

    - Unusual outbound connections from TrueConf processes


    Long-Term Remediation:


  • Conduct a security audit of all TrueConf deployments in your organization
  • If TrueConf is no longer critical to operations, consider migration to alternative platforms with stronger update mechanisms
  • Implement a Software Bill of Materials (SBOM) process to track all conferencing and communication tools in use
  • Establish a vulnerability disclosure agreement with TrueConf to receive advance notification of critical issues

  • ## References


  • TrueConf Official Security Advisory: https://www.trueconf.com/security/cve-2026-3502
  • NIST CVE Database: https://nvd.nist.gov/vuln/detail/CVE-2026-3502
  • CISA Alert on Supply Chain Attacks: https://www.cisa.gov/news/alerts/2026/03/31/
  • Threat Research Report (TrueChaos Campaign): https://www.mandiant.com/resources/reports/trueconf-zero-day-southeast-asia

  • ---


    Key Takeaway: This vulnerability demonstrates why update mechanisms themselves must be hardened and cryptographically validated. Government and enterprise organizations using TrueConf should treat this as a critical-priority patch, not a routine maintenance task. The active exploitation in the wild means attackers are actively hunting for unpatched instances. Delay increases risk of compromise.