Kaspersky researchers have uncovered a series of advanced cyberattacks under the banner Operation ForumTroll, exploiting a Google Chrome zero-day vulnerability (CVE-2025-2783) to deliver espionage-focused malware.
The campaign, active since March 2025, targeted Russian organizations and media outlets using personalized phishing emails that required no further user interaction to compromise devices.
Chrome Zero-Day and Sophisticated Payloads
The first wave of attacks involved a previously unknown Chrome sandbox-escape vulnerability that enabled remote code execution.
Once victims clicked on malicious links in phishing messages disguised as invitations to the Primakov Readings forum, the attackers’ exploit chain automatically infected their systems.
Kaspersky promptly reported the flaw to Google, leading to an emergency patch on March 25, 2025.
According to Kaspersky, all evidence pointed to an APT group using highly targeted phishing and zero-day techniques to infiltrate selected Russian entities.
The campaign’s technical sophistication, combined with the use of commercial spyware tools, reinforced its connection to advanced, well-funded threat actors.
Fall Campaign and Social Engineering Shift
In October 2025, ForumTroll resurfaced with a new phishing campaign that dropped the zero-day exploits in favor of elaborate social engineering. This wave targeted scholars in political science and international relations across major Russian universities.
Emails impersonated Russia’s official eLibrary platform, sent from support@e-library[.]wiki, and lured victims to download a supposedly legitimate plagiarism report.
The malicious website was registered months in advance and hosted a cloned copy of the real eLibrary homepage, with ZIP archives named after each target.
Inside each archive was a malicious LNK file and a decoy directory filled with harmless images. Clicking the shortcut launched a PowerShell script that fetched additional payloads and used COM Hijacking persistence via the registry key {1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}.
The final stage deployed the Tuoni red-teaming framework, giving attackers persistent remote control.
Command-and-control communication was routed through Fastly subdomains, including perf-service-clients2.global.ssl.fastly[.]net and bus-pod-tenant.global.ssl.fastly[.]net.
Kaspersky notes the fall campaign was less technically complex but equally precise in its targeting. The shift from zero-day exploitation to phishing-based delivery suggests the group continues to refine its methods while maintaining a strong focus on Russian-speaking targets.
Given ForumTroll’s long-term activity since at least 2022, further espionage operations are expected.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
