Operation TrueChaos 0-Day Exploitation Against Southeast Asi...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/
• Blog Title: Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets
• Suggested Section: Windows Hardening -> Windows Local Privilege Escalation -> Uiaccess Admin Protection Bypass (or a new page under Windows LPE for 'UAC bypass via auto-elevated iscsicpl.exe + PATH DLL search order hijack'); additionally, a note/example could fit in Generic Hacking or Pentesting Web/AppSec under 'Abusing Auto Updaters / Supply Chain' (if such a section/page exists) describing insecure on-prem update mechanisms leading to mass RCE.

🎯 Content Summary

Blog post: Check Point Research details an in-the-wild zero-day in the TrueConf Windows client updater, tracked as CVE-2026-3502 (CVSS 7.8), exploited in a campaign dubbed Operation “TrueChaos” targeting Southeast Asian government entities.

1) Background / why this matters (trust model)
TrueConf is frequently deployed on-premises in sensitive environments (government/military/critical infrastructure) specifically because it can operate entir...

🔧 Technical Details

1. Abuse on-prem “trusted update” channels to achieve org-wide code execution: If an enterprise client compares versions against an on-prem server and downloads an installer (e.g., https://{server}/downlods/trueconf_client.exe) but does not enforce strong authenticity/integrity validation of the update artifact, then any attacker who can control the server (or the hosted update file path) can replace the update with an arbitrary executable and achieve large-scale code execution across all connected endpoints via the normal update UX/trust relationship.
   
   2) Blend malicious code into a legitimate upgrade using DLL side-loading: Ship an installer that performs a real version upgrade to reduce suspicion, while dropping a legitimate/benign executable plus a malicious DLL with a name the executable will load (e.g., poweriso.exe + 7z-x64.dll in C:\ProgramData\PowerISO</code>). Launching/running the executable loads the attack...

🤖 Agent Actions

I’m mapping the relevant HackTricks sections first, then I’ll read the closest existing Windows LPE and DLL hijack pages before deciding on a single target file.
I found strong candidates already: existing pages for uiaccess-admin-protection-bypass, DLL hijacking, and auto-updaters. Next I’m reading those pages plus adjacent indexes to avoid duplicating content and to match HackTricks style.
The repo already has updater-abuse content, but it does not cover the iscsicpl.exe UAC bypass chain. I’m treating that as the best non-duplicative addition and patching the UAC page with the concrete HKCU\\Environment\\Path + SysWOW64\\iscsicpl.exe workflow.
I’ve chosen the single-file target. Next I’m adding only the missing iscsicpl.exe UAC-bypass technique, with minimal detection notes and references, so the update stays focused and non-redundant.
Updated uac-user-account-control.md with a new subsection documenting the missing technique from the blog: SysWOW64\iscsicpl.exe auto-elevation combined with HKCU\Environment\Path DLL search-order hijacking for iscsiexe.dll.

I chose that file because the repo already has separate updater-abuse content, while this specific UAC bypass was not documented yet. The patch adds the exploitation flow, constraints, concise detection ideas, and references to both LOLBAS and the Check Point blog. I verified the final content with sed, tail, and git diff.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Windows Local Privilege Escalation -> Uiaccess Admin Protection Bypass (or a new page under Windows LPE for 'UAC bypass via auto-elevated iscsicpl.exe + PATH DLL search order hijack'); additionally, a note/example could fit in Generic Hacking or Pentesting Web/AppSec under 'Abusing Auto Updaters / Supply Chain' (if such a section/page exists) describing insecure on-prem update mechanisms leading to mass RCE.".

Repository Maintenance:

• MD Files Formatting: 964 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0