In mid-March 2025, Kaspersky detected a wave of infections utilizing a previously unknown and highly sophisticated malware strain.
The attacks, dubbed Operation ForumTroll, exploited a zero-day vulnerability in Google Chrome (CVE-2025-2783) to bypass the browser’s sandbox protection.
The campaign targeted media outlets and educational institutions in Russia through personalized phishing emails purportedly from organizers of the “Primakov Readings” scientific forum.
Victims were infected simply by clicking on malicious links in these emails, with no further action required.
Exploit Chain and Vulnerability Details
The attack leveraged a chain of exploits, including the Chrome zero-day and an additional remote code execution exploit.
The Chrome vulnerability (CVE-2025-2783) allowed attackers to bypass sandbox protections due to a logical error at the intersection of Chrome’s sandbox and the Windows operating system.
Kaspersky’s exploit detection technologies identified the zero-day, enabling them to report it to Google.
Google released an update (Chrome 134.0.6998.177/.178) addressing the vulnerability.
APT Group Attribution and Malware Sophistication
Based on the attack artifacts and the sophistication of the malware used, Kaspersky researchers confidently attribute this campaign to a state-sponsored APT group.
The malware’s functionality suggests that the primary goal of the attackers was espionage.
The exploit chain was designed to work in conjunction with an additional remote code execution exploit, which researchers were unable to obtain.
However, patching the sandbox escape vulnerability effectively blocks the entire attack chain.
Kaspersky products detect the exploits and malware used in this attack with various verdicts, including Exploit.Win32.Generic, Trojan.Win64.Agent, and Trojan.Win64.Convagent.gen.
The company advises against clicking on any potentially malicious links and recommends updating to the latest version of Google Chrome to mitigate the vulnerability.
As of the current date (March 26, 2025), the malicious links are no longer active and redirect visitors to the official “Primakov Readings” website.
Kaspersky plans to publish a detailed technical report on the zero-day exploit, sophisticated malware, and the attackers’ techniques in the near future.
Find this Story Interesting! Follow us on LinkedIn, and X to Get More Instant Updates
.webp?fit=1068,580&ssl=1&description=In mid-March 2025, Kaspersky detected a wave of infections utilizing a previously unknown and highly sophisticated malware strain.){kind=link}