New ForumTroll Phishing Attacks Target Russian Scholars Using Fake eLibrary Emails

The threat actor linked to Operation ForumTroll has been attributed to a fresh set of phishing attacks targeting individuals within Russia, according to Kaspersky. The Russian cybersecurity vendor said it detected the new activity in October 2025, and the origins of the threat actor are presently unknown.

While the spring cyberattacks targeted organisations, the fall campaign honed in on specific individuals: scholars in political science, international relations, and global economics at major Russian universities and research institutions. The campaigns exploit a then-zero-day vulnerability in Google Chrome (CVE-2025-2783) to deliver the LeetAgent backdoor and a spyware implant known as Dante.

The latest attacks commence with emails that claim to be from eLibrary, a Russian scientific electronic library, with messages sent from the address "support@e-librarywiki." The domain was registered in March 2025, six months before the campaign began, suggesting preparations had been underway for some time.