Phishing & fraudcritical
New ForumTroll Phishing Attacks Target Russian Scholars Using Fake eLibrary Emails
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-38035 | Authentication Bypass in Ivanti Sentry (MobileIron Sentry) Admin Interface | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2024-21887 | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 | 100% | KEVRansomwarePoC | KEV |
| CVE-2025-2783 | Sandbox Escape via Mojo Handle Flaw in Google Chrome on Windows (CVE-2025-2783) | 8.3 | 9% | KEV | KEV |
CVE-2025-4428+1 related CVE | Authenticated Code Injection RCE in Ivanti Endpoint Manager Mobile (EPMM) API | 8.8 group max | 88% | KEV | KEV |
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | elibrary.ru | rs also hosted a copy of the legitimate eLibrary homepage ("elibrary[.]ru") on the bogus domain to maintain the ruse. The emails in |
| domain | e-library.wiki | c library, with the messages sent from the address "support@e-library[.]wiki." The domain was registered in March 2025, six months bef |
From the original article
3 min read at thehackernews.com
The threat actor linked to Operation ForumTroll has been attributed to a fresh set of phishing attacks targeting individuals within Russia, according to Kaspersky. The Russian cybersecurity vendor said it detected the new activity in October 2025. The origins of the threat actor are presently unknown.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.