ForumTroll
Summary
Espionage actor that has targeted organisations and individuals in Russia and Belarus since at least 2022. In March 2025 personalised invitations to the Primakov Readings forum led to one-click infection through a Chrome sandbox-escape zero-day (CVE-2025-2783) and the LeetAgent backdoor; in October 2025 it phished Russian political scientists with fake eLibrary plagiarism reports. Kaspersky found LeetAgent loading Dante — commercial spyware from Italy's Memento Labs (formerly Hacking Team), sold to law-enforcement and intelligence customers — the first in-the-wild use of Dante. Kaspersky could not determine who commissioned the operations; the lures show fluent Russian but mistakes suggest non-native speakers. Positive Technologies attributes the same March 2025 Chrome exploitation to a cluster it calls TaxOff (likely the same as its Team46).
Attribution
Operator and customer unknown
Tracked by researchers; no state or organisation has been publicly attributed.
- Kaspersky GReAT (Research, 2025-10-27)
Uses Dante, commercial spyware sold by Memento Labs - Kaspersky GReAT (Research, 2025-10-27)
Operators fluent but not native Russian speakers
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Fake eLibrary plagiarism reports against Russian political scientists | 2025-10 | Russia | Academia, Research | Kaspersky GReAT (2025-12-17) |
| Operation ForumTroll — Primakov Readings lures, Chrome sandbox-escape zero-day → LeetAgent | 2025-03 | Russia | Media, Government, Academia | Kaspersky GReAT (2025-03-25) |
| LeetAgent and Memento Labs Dante spyware intrusions in Russia and Belarus | 2022 – 2025 | Russia, Belarus | Government, Research | Kaspersky GReAT (2025-10-27) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Initial Access2 | T1566.002Spearphishing LinkT1566.001Spearphishing Attachment |
|---|---|
| Execution2 | T1203Exploitation for Client ExecutionT1059.001PowerShell |
| Privilege Escalation1 | T1546.015Component Object Model Hijacking |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| LeetAgent | Backdoor (commands in leetspeak) | Windows |
| Dante | Commercial spyware (Memento Labs) | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2025-2783 | 8.3 | Google Chrome Mojo — sandbox escape (KEV 2025-03-27) |
Highest CVSS first.
Infrastructure patterns
- C2 hosted on Fastly.net cloud infrastructure, consistently across its 2025 campaigns (Kaspersky, 2025)