Threat actorcritical
A new campaign by the ForumTroll APT group
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-2783 | Sandbox Escape via Mojo Handle Flaw in Google Chrome on Windows (CVE-2025-2783) | 8.3 | 9% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | elibrary.ru | c electronic library, eLibrary, whose legitimate website is elibrary.ru . The phishing emails contained a malicious link in the for |
| domain | e-library.wiki | received by the victims were sent from the address support@e-library[.]wiki . The campaign purported to be from the scientific electr |
| domain | fastly.net | ompromise e-library[.]wiki perf-service-clients2.global.ssl.fastly[.]net bus-pod-tenant.global.ssl.fastly[.]net status-portal-api. |
| ipv4 | 193.65.18.14 | e, they accessed the legitimate website from the IP address 193.65.18[.]14 back in December 2024. A screenshot of the malicious site |
From the original article
5 min read at securelist.com
In March 2025, we discovered Operation ForumTroll , a series of sophisticated cyberattacks exploiting the CVE-2025-2783 vulnerability in Google Chrome. We previously detailed the malicious implants used in the operation: the LeetAgent backdoor and the complex spyware Dante, developed by Memento Labs (formerly Hacking Team).
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.