Head Mare exploits two TrueConf flaws to gain SYSTEM privileges and replace client installers with PhantomCore malware across Russian companies.