Loading story…
Operation ForumTroll, an advanced persistent threat group, has launched a highly targeted phishing campaign against Russian political scientists and researchers at major universities and research institutions. The attackers impersonated the legitimate Russian scientific electronic library eLibrary, sending personalized phishing emails from the address support@e-library[.]wiki and prompting recipients to download supposed plagiarism reports. The malicious links led to ZIP archives named after the victims, containing malware such as the LeetAgent backdoor and Dante spyware, both previously associated with this group. The campaign demonstrates significant preparation, including registering the malicious domain six months in advance and cloning the legitimate eLibrary homepage to enhance credibility and evade detection.
The phishing campaign was first detected in October 2025 by Kaspersky and Securelist researchers, who noted that the attackers shifted their focus from organizations in the spring to individual scholars in the fall. The malicious domain was aged strategically to avoid spam filters, and the phishing links were designed for one-time use, complicating security analysis. The operation highlights the evolving tactics of Operation ForumTroll, which previously exploited the Google Chrome zero-day vulnerability CVE-2025-2783, and underscores the ongoing threat to academic and research communities in Russia from sophisticated, well-resourced threat actors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On December 17-18, 2025, multiple security outlets reported Kaspersky/Securelist findings on the newly identified ForumTroll operation targeting Russian scholars with fake eLibrary emails and plagiarism-themed lures. The reporting disclosed the campaign's targeting, delivery methods, and malware chain.
The campaign exploited Google Chrome zero-day CVE-2025-2783 to execute a PowerShell-based infection chain that downloaded DLL payloads, established persistence via COM hijacking, and deployed malware including LeetAgent, Dante, and the Tuoni C2 framework. The activity demonstrated a sophisticated espionage-oriented intrusion set focused on Russian academic targets.
The attackers sent tailored phishing emails impersonating eLibrary and fake plagiarism-report notifications to lure scholars into opening malicious files. Victims were directed to download personalized ZIP archives containing a malicious shortcut and decoy content.
In October 2025, researchers detected a new ForumTroll campaign aimed at Russian political science, international relations, and economics scholars at major universities and research institutions. The operation marked a shift from targeting organizations to targeting individual academics with highly personalized lures.
ForumTroll prepared the campaign by registering a lookalike eLibrary domain months before the attacks and cloning the service's homepage to support phishing and evade detection. The infrastructure was aged and configured with one-time-use links and other anti-analysis measures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky researchers identified a sophisticated cyber-espionage campaign, dubbed Operation ForumTroll, targeting organizations in Russia and Belarus. Attackers sent highly personalized phishing emails inviting recipients to the Primakov Readings forum, with links that, when clicked in Google Chrome or other Chromium-based browsers, exploited a zero-day vulnerability (CVE-2025-2783) to deliver malware. The campaign primarily targeted media outlets, universities, research centers, government organizations, and financial institutions, with the infection requiring no further user interaction beyond visiting the malicious site. The malware used in these attacks, initially named LeetAgent, communicated with its command server using obfuscated commands and was designed for espionage purposes. Further investigation revealed that the tools and malware used in Operation ForumTroll were linked to the commercial spyware Dante, developed by the Italian company Memento Labs (formerly Hacking Team). The malware exhibited a modular structure, unique encryption keys per victim, and self-destruct capabilities. Analysis traced the use of Dante spyware in attacks dating back to 2022, indicating a broader campaign by the ForumTroll APT group and highlighting the continued evolution and deployment of commercial surveillance tools in targeted attacks against Russian and Belarusian entities.
Jun 29, 2026
Citizen Lab and Access Now documented a sophisticated spear-phishing campaign targeting Russian opposition figures, Belarusian and Russian civil society groups, independent media, international NGOs active in Eastern Europe, policy experts, funders, journalists, and at least one former U.S. ambassador. Researchers attributed one cluster to **COLDRIVER**—also tracked as **Star Blizzard**, **Callisto**, **TA446**, **Blue Charlie**, and **UNC4057**—a Russia-linked threat actor that multiple governments have associated with the FSB’s Centre 18, while identifying a separate but related phishing cluster as **COLDWASTREL**. The operations used highly personalized impersonation emails sent from compromised or lookalike accounts, along with fake encrypted or protected PDF lures that redirected victims through fingerprinting infrastructure to credential-harvesting pages spoofing services such as Gmail and ProtonMail. Investigators found overlaps with known COLDRIVER tradecraft, including Hostinger-registered domains, Let’s Encrypt or ZeroSSL certificates, LibreOffice 7.0 PDF metadata, randomized author names, and occasional HubSpot links, while COLDWASTREL showed distinct metadata, infrastructure, and domain patterns. The groups sought passwords, two-factor authentication codes, and session cookies, raising the risk of exposing sensitive identities, communications, relationships, and locations of organizations already facing Russian government repression.
Jul 12, 2026
A Russia-linked threat actor known as Callisto, also referred to as ColdRiver or Star Blizzard, attempted to compromise the nonprofit organization Reporters Without Borders (RSF) through a sophisticated phishing campaign. The attack involved credential-harvesting tactics, including the use of a ProtonMail account impersonating a trusted contact and a lure referencing a missing file. The phishing email, written in French and using a legitimate signature, prompted the recipient to request a follow-up document, after which a malicious link was sent. This link redirected the target to a spoofed ProtonMail login page designed to steal credentials. The campaign leveraged advanced adversary-in-the-middle (AiTM) phishing techniques and social engineering, with the attacker switching languages and using compromised websites to host malicious content. RSF, which supports journalists under threat and has been labeled an "undesirable organization" by the Kremlin, was specifically targeted, highlighting the ongoing focus of Russian APTs on NGOs and organizations supporting Ukraine. The attack was ultimately thwarted when ProtonMail blocked the attacker's account, preventing the malicious file from being delivered. Security researchers noted that similar lures were used against other organizations, and the campaign reflects a broader trend of Russian APTs using custom phishing kits and social engineering to target high-profile entities. The incident underscores the persistent threat posed by Russian state-aligned actors to civil society organizations and the need for robust email security and user awareness training.
Jun 29, 2026