Operation ForumTroll continues: Russian political scientists targeted using plagiarism reports

Kaspersky’s GReAT researchers report that Operation ForumTroll has continued into 2025, targeting Russian political scientists with a new phishing campaign that uses plagiarism reports to entice victims. The fall campaign, dated 17 December 2025 in Securelist, sent emails posing as the scientific library eLibrary from the address support@e-librarywiki and directing recipients to a malicious link that downloads a victim-specific archive.

Investigators note that the malicious domain e-librarywiki was registered in March 2025, and the site even replicated the legitimate eLibrary homepage from an IP address 193.65.18[.]14 observed in December 2024. The infection chain relies on a PowerShell-based payload launched from a shortcut, which then contacts a fastly[.]net domain to fetch a final DLL loader and uses COM Hijacking for persistence, with the final payload delivering the Tuoni framework for remote access.

The report contrasts this autumn campaign with the spring operation, which exploited zero-days, and observes that ForumTroll has previously deployed LeetAgent and Dante, developed by Memento Labs, though the fall campaign relies more on social engineering. The findings indicate continued targeting of individuals and organisations in Russia and Belarus since at least 2022, with the authors emphasising the value of studying ForumTroll’s implants and methods.