Academic Ambush: How the Forum Troll APT Hijacks Scholars’ Systems via Fake Plagiarism Reports

According to Kaspersky Labs, a relentless Advanced Persistent Threat group known as “Forum Troll” has pivoted from corporate networks to targeting the academic elite, conducting a precision phishing campaign against Russian political scientists and economists in October 2025. The fall operation impersonated the eLibrary platform to persuade scholars to download what they believed were plagiarism reports, using emails from a spoofed domain registered months in advance to build trust.

Victims received archives named with their full names (for example LastName_FirstName_Patronymic).zip, containing a disguised .lnk file and a hidden ThumbS directory filled with irrelevant images to appear legitimate, before a PowerShell-based multi-stage infection chain reached a DLL payload via a command-and-control server.

The attackers shifted to the Tuoni commercial red-teaming framework to gain remote access, deploying a decoy PDF of a blurred plagiarism report to mask the breach, and implementing one-time-use links and Windows-only filtering to hinder analysis. Kaspersky notes the group has targeted Russia and Belarus since at least 2022, suggesting continued espionage against high-value academic targets in the region.