Free, Unbiased, and Open threat intelligence
Free, Unbiased, and Open threat intelligence
threat Profile
Kaspersky discovered Operation ForumTroll in March 2025, a sophisticated espionage campaign targeting media outlets, universities, research centers, government organizations, and financial institutions in Russia and Belarus. The attack used personalized spear-phishing emails disguised as invitations to the Primakov Readings forum containing extremely short-lived malicious links. Infection occurred through a zero-day Chrome sandbox escape exploit (CVE-2025-2783) that required no user interaction beyond visiting the malicious website using Chromium-based browsers. The exploit leveraged a logical vulnerability in Windows pseudo handles, specifically exploiting the GetCurrentThread API function that returns pseudo handle -2. Chrome's IPC code checked for -1 (GetCurrentProcess) but not -2, allowing attackers to use RelayMessage to convert the pseudo handle into a real browser process thread handle via DuplicateHandle, enabling arbitrary code execution through thread manipulation (suspend, SetThreadContext, resume). Persistence was achieved via COM hijacking of twinapi.dll CLSID {AA509086-5Ca9-4C25-8F95-589D3C07B48A}. The campaign deployed LeetAgent spyware with commands in leetspeak (0xC033A4D=COMMAND, 0xECEC=EXEC, etc.) performing keylogging, file stealing (targeting .doc, .xls, .ppt, .rtf, .pdf extensions), and command execution. Kaspersky traced attacks back to 2022 and discovered Dante spyware, commercial surveillance tool developed by Memento Labs (formerly Hacking Team). Dante is VMProtect-packed with extensive anti-analysis techniques including anti-hooking via system call stubs, debug register checks, Windows Event Log monitoring for analysis tools, and anti-sandbox checks. The malware uses orchestrator architecture with AES-256-CBC encrypted modules, configuration stored with DANTEMARKER string, and self-deletion after specified days without C2 communication. Attribution confirmed through code similarities between exploit, loader, and Dante, plus shared infrastructure with Fastly.net CDN for C2. Mozilla Firefox also affected (CVE-2025-2857).
Threat Actors
Published
7 months ago
Views
10