ForumTroll

ForumTroll is a cyber-espionage threat cluster active since at least 2022 and known for targeting organizations and individuals in Russia and Belarus. The group has been associated with highly tailored spear-phishing campaigns using topical social-engineering lures, including fake invitations to the Primakov Readings forum and fraudulent plagiarism-report themes aimed at scholars and political experts. Victimology includes government bodies, media outlets, universities, research institutions, financial organizations, and individual academics, particularly in political science, international relations, and economics. ForumTroll is notable for combining precise targeting with advanced exploitation. In 2025 it was linked to Operation ForumTroll, a campaign that used personalized, short-lived phishing links and a malicious website to exploit Google Chrome sandbox-escape vulnerability CVE-2025-2783 against Chromium-based browsers. The intrusion chain included victim validation logic, staged payload delivery, and post-compromise malware deployment. Persistence has been achieved through COM hijacking, and the group has used loaders and implants designed to activate selectively and evade analysis. The principal malware associated with ForumTroll is LeetAgent, a spyware backdoor supporting remote command execution, process execution, task management, file operations, shellcode injection, configuration changes, keylogging, and theft of documents. ForumTroll-linked activity has also been connected to Dante, a more advanced commercial spyware platform attributed to the Italian surveillance vendor Memento Labs, the successor to Hacking Team. LeetAgent has at times been used as a loader for Dante, and technical overlaps have been reported among ForumTroll exploit code, loaders, and Dante-related tooling. Later activity also delivered the Tuoni command-and-control and red-teaming framework. The actor’s tradecraft includes spear-phishing, browser exploitation, selective payload staging, persistence, credential-adjacent surveillance through keylogging, and document exfiltration. The campaigns are assessed as espionage-focused. Although the operators have demonstrated strong familiarity with Russian-language and local contextual themes, publicly available reporting does not establish the actor’s own national origin with high confidence. Known aliases include Forum Troll APT, forum_troll_apt, forumtroll_apt, and forumtroll_apt_group.