Kaspersky Technologies uncovered a sophisticated cyber espionage operation in mid-March 2025, dubbing the campaign "Operation ForumTroll." This complex scheme involved malware infections triggered by carefully crafted phishing emails that exploited a zero-day vulnerability in Google Chrome, tracked as CVE-2025-2783. The attack specifically targeted a variety of Russian organizations, including media outlets, educational institutions, and government agencies.
The infiltration began when victims unwittingly clicked on personalized links contained within the phishing emails. As a result, their systems were compromised simply by opening a booby-trapped website through the Google Chrome browser. Kaspersky's exploit detection and protection technologies identified the zero-day exploit and reported the issue to Google shortly after the attack discovery.
Following Kaspersky's action, Google raced to patch the critical vulnerability on March 25, 2025. The developers successfully addressed the issue, thus neutralizing the potential for further exploitation. Kaspersky received acknowledgment from Google for their timely detection and reporting. According to Kaspersky's technical analysis, this vulnerability allowed attackers to escape Chrome's sandbox protection without any overtly malicious actions, posing a significant security flaw that required immediate attention.
During the investigations, researchers noted the phishing emails masqueraded as invitations from organizers of a scientific forum, "Primakov Readings." This clever ruse was aimed at tricking recipients into unwittingly downloading additional malicious software. The entire operation appeared to bear the hallmarks of a state-sponsored advanced persistent threat (APT) group, indicating that the attackers possessed a high level of sophistication.
“We have discovered and reported dozens of zero-day exploits actively used in attacks, but this particular exploit is certainly one of the most interesting we’ve encountered,” said Kaspersky researchers. They emphasized the complexity of the attack chain that utilized the zero-day exploit. Despite their best efforts, Kaspersky was unable to obtain a second exploit that enabled remote code execution, which would have required exposing users to additional risk.
In their retrospective evaluation of the threat, Kaspersky's researchers pointed out that they hadn’t identified any active exploits at the malicious link at the time of their reporting, as it simply redirected users to the official site of the "Primakov Readings." However, the potential for future infections remained a concern until the patch was effectively implemented across user systems.
“The vulnerability CVE-2025-2783 really left us scratching our heads, as, without doing anything obviously malicious or forbidden, it allowed the attackers to bypass Google Chrome’s sandbox protection as if it didn’t even exist,” noted Kaspersky researchers, describing the underlying logical error at the intersection of Chrome’s sandbox and the Windows operating system.
Kaspersky’s comprehensive detection products uncovered various forms of the malware employed in this operation, with verdicts spanning a range of categories, including "Exploit.Win32.Generic" and "Trojan.Win64.Agent." Identifying and blocking these threats have become pivotal in mitigating risks posed to users during this sophisticated cyber attack.
As research continues, Kaspersky has decided to delay publishing detailed technical reports until a majority of Google Chrome users have installed the latest security patch. The balance between transparency in cybersecurity and the necessity to protect users remains vital as they navigate this complex digital landscape.
In this context, all the attack artifacts analyzed so far indicate high sophistication from the attackers, reinforcing Kaspersky's conclusion that a state-sponsored APT group is behind this operation.
Overall, the collaboration between Kaspersky and Google exemplifies the proactive measures necessary to ensure user security while navigating the modern-day cyber threat landscape. While patches and exploits can seem like troublesome issues, recognizing their critical nature is essential for maintaining the integrity of our digital environments. As emphasized by Kaspersky, trained cybersecurity professionals play an invaluable role in preventing and mitigating such sophisticated attacks.
