Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets

Key Points Check Point Research identified a zero-day vulnerability in the TrueConf client application, tracked as CVE-2026-3502 , with a CVSS score of 7.8 . The flaw stems from the abuse of TrueConf’s updater validation mechanism, allowing an attacker who controls the on-premises TrueConf server to distribute and execute arbitrary files across all connected endpoints. This vulnerability has been exploited in-the-wild as part of a targeted campaign we call “TrueChaos” against government entities