{"id":"trueconf-client-update-attacks-mar-2026","category":"patch","status":"closed","title":"TrueConf Client update flaw CVE-2026-3502 used against government organisations; fix available","tldr":"Attackers used tampered TrueConf updates to infect Windows computers in Southeast Asian government organisations. Versions 8.1.0–8.5.2 are affected. Install 8.5.3.884 or later from TrueConf, and ask IT to check for compromise.","summary":"TrueConf Client’s Windows updater could run downloaded software without adequately checking its authenticity. Attackers who controlled an organisation’s TrueConf server used this weakness to send malicious updates to connected computers. Check Point observed the TrueChaos campaign at the beginning of 2026 against government organisations in Southeast Asia; one compromised server supplied dozens of government entities. It attributed the activity to a China-linked actor with moderate confidence. TrueConf identifies versions 8.1.0–8.5.2 as affected and 8.5.3.884 or later as fixed. The fix was released in March, before CISA listed the flaw as exploited on 2 April. As of 3 November, a fix is available, but the reviewed sources do not establish whether the campaign has ended or all affected organisations have removed the malware.","action":"If you use TrueConf on Windows, install version 8.5.3.884 or later from TrueConf’s official website, or ask your IT team to do it. If your organisation used an affected version, ask IT to check its TrueConf server and connected computers for signs of compromise.","product":"TrueConf Client for Windows","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-3502"],"tags":["trueconf","windows","zero-day","malicious-update","code-execution"],"affected":["TrueConf Client for Windows 8.1.0–8.5.2"],"fixed":["TrueConf Client for Windows 8.5.3.884 or later"],"matches":[{"platform":"windows","app":"TrueConf","bundle":"","fixed":"8.5.3.884"}],"sources":[{"kind":"advisory","title":"TrueConf Security Vulnerabilities, Fixes and Advisories","url":"https://trueconf.com/blog/news/security-fixes-updates-and-advisories","by":"TrueConf","date":"2026-06-11"},{"kind":"advisory","title":"TrueConf 8.5 for desktops OS: new interface, AI, and advanced messenger","url":"https://trueconf.com/blog/update/trueconf-8-5","by":"TrueConf","date":"2025-08-14"},{"kind":"advisory","title":"TrueConf 8 for Windows","url":"https://trueconf.com/downloads/windows.html","by":"TrueConf","date":""},{"kind":"advisory","title":"CVE-2026-3502","url":"https://www.cve.org/CVERecord?id=CVE-2026-3502","by":"CVE","date":"2026-03-30"},{"kind":"research","title":"Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets","url":"https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/","by":"Check Point Research","date":"2026-03-31"},{"kind":"news","title":"TrueConf Zero-Day Exploited in Asian Government Attacks","url":"https://www.securityweek.com/trueconf-zero-day-exploited-in-asian-government-attacks/","by":"SecurityWeek","date":"2026-04-03"}],"started":"2026-04-02","closed":"2026-06-11","created":"2026-11-03T22:29:03.387Z","updated":"2026-11-03T22:29:03.387Z","cve_notes":[{"cve":"CVE-2026-3502","name":"Unverified software updates in TrueConf Client","what":"Insufficient verification in TrueConf Client’s updater lets an attacker who controls the update source supply tampered software that can run code on the updating computer.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-06-11","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"TrueConf published its security reference page. It lists versions 8.1.0–8.5.2 as affected and identifies 8.5.3.884 or later as the resolution.","url":"https://trueconf.com/blog/news/security-fixes-updates-and-advisories","by":"TrueConf","patch":null},{"at":"2026-04-02","added":"2026-11-03T22:22:59.664Z","kind":"cisa-added","text":"CISA added CVE-2026-3502 to its Known Exploited Vulnerabilities catalogue, requiring US federal civilian agencies to address it by 16 April.","url":"https://www.securityweek.com/trueconf-zero-day-exploited-in-asian-government-attacks/","by":"SecurityWeek","patch":null},{"at":"2026-03-31","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"Check Point disclosed TrueChaos, attacks it observed at the beginning of 2026 against Southeast Asian government organisations. It reported that TrueConf had released a Windows client fix in version 8.5.3 during March.","url":"https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/","by":"Check Point Research","patch":"patched"},{"at":"2026-03-30","added":"2026-11-03T22:22:59.664Z","kind":"disclosed","text":"The CVE record was published for CVE-2026-3502, affecting TrueConf Client versions 8.1.0 through 8.5.2.","url":"https://www.cve.org/CVERecord?id=CVE-2026-3502","by":"CVE","patch":null}],"url":"https://hard.fyi/live/trueconf-client-update-attacks-mar-2026/","json":"https://hard.fyi/api/live?id=trueconf-client-update-attacks-mar-2026"}