https://reddit.com/r/cybersecurity/comments/1s9tv10/trueconf_zeroday_exploited_in_southeast_asia_to/: TrueConf Zero-Day Exploited in Southeast Asia to Push Havoc via Trusted Update Channel
Affected Software
Frequently Asked Questions
Which deployments are most exposed to this attack?
Organizations using the TrueConf Windows client with an on-premises update server are exposed if that server can be used to distribute a malicious update. The reported campaign affected multiple government entities in Southeast Asia.
What does an attacker need to exploit this issue?
The attack requires the ability to push a malicious update through a trusted on-prem TrueConf server. The reported activity then used DLL sideloading and UAC bypass to execute payloads and establish Havoc C2 communications.
Are installations on the fixed release affected?
The flaw is fixed in TrueConf 8.5.3. Systems running that version are not affected by the described update-validation flaw.
What can defenders do if they cannot immediately update?
Investigate update-server activity and endpoints for trueconf_windows_update.exe, C:\ProgramData\PowerISO\poweriso.exe, 7z-x64.dll, and iscsiexe.dll. Also review and block or investigate outbound connections to 43.134.90[.]60, 43.134.52[.]221, and 47.237.15[.]197.
How can an organization determine whether it may already be compromised?
Hunt for the listed files and DLLs, especially the PowerISO path and trueconf_windows_update.exe, and correlate them with outbound traffic to the three identified IP addresses. Evidence of DLL sideloading, UAC bypass, or Havoc-related command-and-control activity should be treated as suspicious.