TrueConf Zero-Day Exploited in Asian Government Attacks by Chinese Hackers

Key Points

• Chinese hackers exploited zero-day vulnerability in TrueConf video conferencing software
• Compromised central server serving dozens of government entities
• Attackers replaced legitimate updates with malicious code
• Attribution to Chinese threat actors by Check Point researchers

Full Details

Security researchers at Check Point have uncovered a sophisticated cyberattack campaign, dubbed TrueChaos, in which Chinese hackers exploited a zero-day vulnerability in the TrueConf video conferencing platform. The attackers compromised an on-premises TrueConf server operated by a governmental IT department, which served as the video conferencing platform for dozens of government entities across the country. The hackers replaced legitimate software updates with malicious ones, effectively infecting all clients that connected to the compromised server. This attack demonstrates how threat actors abuse trusted relationships between central infrastructure and end users. The incident highlights the significant risks of supply chain attacks in government IT systems and the sophistication of state-sponsored cyber operations targeting Asian governments.