Loading story…
Kaspersky researchers identified a sophisticated cyber-espionage campaign, dubbed Operation ForumTroll, targeting organizations in Russia and Belarus. Attackers sent highly personalized phishing emails inviting recipients to the Primakov Readings forum, with links that, when clicked in Google Chrome or other Chromium-based browsers, exploited a zero-day vulnerability (CVE-2025-2783) to deliver malware. The campaign primarily targeted media outlets, universities, research centers, government organizations, and financial institutions, with the infection requiring no further user interaction beyond visiting the malicious site. The malware used in these attacks, initially named LeetAgent, communicated with its command server using obfuscated commands and was designed for espionage purposes.
Further investigation revealed that the tools and malware used in Operation ForumTroll were linked to the commercial spyware Dante, developed by the Italian company Memento Labs (formerly Hacking Team). The malware exhibited a modular structure, unique encryption keys per victim, and self-destruct capabilities. Analysis traced the use of Dante spyware in attacks dating back to 2022, indicating a broader campaign by the ForumTroll APT group and highlighting the continued evolution and deployment of commercial surveillance tools in targeted attacks against Russian and Belarusian entities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Kaspersky publicly disclosed detailed technical findings on Operation ForumTroll, LeetAgent, CVE-2025-2783 exploitation, and links to Dante, along with indicators of compromise. The report also warned that the pseudo-handle abuse behind CVE-2025-2783 may represent a broader class of vulnerabilities affecting other applications and Windows services.
By October 2025, Kaspersky concluded that Operation ForumTroll was likely connected to the broader toolset associated with Dante, a commercial spyware platform developed by Memento Labs, formerly Hacking Team. The attribution was based on deobfuscation results, code overlap, and shared tactics, even though Dante was not directly observed in the March infection wave.
After Kaspersky reported the issue, Google fixed the Chrome sandbox escape vulnerability CVE-2025-2783 in Chrome 134.0.6998.177/.178. The flaw abused a Windows pseudo-handle quirk during IPC handle relaying to obtain a real browser-process thread handle and execute shellcode.
The March 2025 ForumTroll campaign delivered the LeetAgent espionage implant to government, media, research, and private-sector targets in Russia and Belarus. The malware supported HTTPS command-and-control, keylogging, document theft, and follow-on tool downloads, with persistence established via COM hijacking.
In March 2025, attackers launched a spearphishing campaign using fake Primakov Readings forum invitations that led victims to short-lived malicious links. Simply visiting the link in Chrome or another Chromium-based browser triggered exploitation of a sandbox escape later tracked as CVE-2025-2783.
Kaspersky found related activity associated with the broader ForumTroll/Dante toolset dating back to 2022, affecting targets in Russia and Belarus. This earlier activity helped establish historical infrastructure, tooling, and TTP overlap later used for attribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcesecurelist.com
Open sourcesecurityaffairs.com
Open sourcekaspersky.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Operation ForumTroll, an advanced persistent threat group, has launched a highly targeted phishing campaign against Russian political scientists and researchers at major universities and research institutions. The attackers impersonated the legitimate Russian scientific electronic library eLibrary, sending personalized phishing emails from the address `support@e-library[.]wiki` and prompting recipients to download supposed plagiarism reports. The malicious links led to ZIP archives named after the victims, containing malware such as the LeetAgent backdoor and Dante spyware, both previously associated with this group. The campaign demonstrates significant preparation, including registering the malicious domain six months in advance and cloning the legitimate eLibrary homepage to enhance credibility and evade detection. The phishing campaign was first detected in October 2025 by Kaspersky and Securelist researchers, who noted that the attackers shifted their focus from organizations in the spring to individual scholars in the fall. The malicious domain was aged strategically to avoid spam filters, and the phishing links were designed for one-time use, complicating security analysis. The operation highlights the evolving tactics of Operation ForumTroll, which previously exploited the Google Chrome zero-day vulnerability CVE-2025-2783, and underscores the ongoing threat to academic and research communities in Russia from sophisticated, well-resourced threat actors.
Jun 29, 2026
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026