Mem3nt0 mori – The Hacking Team is back!

Kaspersky researchers described a wave of infections in March 2025 where victims clicked personalised phishing links that opened in Chromium-based browsers, with the attackers using a zero-day exploit to escape Chrome’s sandbox. The campaign, dubbed Operation ForumTroll, targeted Russia-linked media outlets, universities, and government organisations, and led to the discovery of a commercial spyware called Dante developed by Memento Labs (formerly Hacking Team).

The researchers traced Dante back to 2022 and linked it to the ForumTroll attack chain via code similarities, persistence methods, and shared loader and exploit components, noting that LeetAgent is the spyware used in ForumTroll and that the campaign also involved a more sophisticated spyware in some clusters. CVE-2025-2783 was identified as the sandbox escape, and Google Chrome was patched as a result; Mozilla Firefox later issued a related update for CVE-2025-2857.

The attribution ties ForumTroll to Dante, with the researchers emphasising the challenges of linking unknown malware to threat actors and highlighting Hacking Team/Memento Labs’ long history in surveillance software.