A critical Google Chrome zero-day vulnerability (CVE-2025-2783) exploited earlier this year has been linked to Memento Labs, an Italian spyware company descended from the notorious Hacking Team.
Operation ForumTroll
Discovered by Kaspersky in March 2025, Operation ForumTroll targeted Russian organizations — including media outlets, universities, research institutions, government agencies, and financial firms.
Attackers sent sophisticated invitations to the Primakov Readings forum containing a malicious link. Merely loading this link in any Chromium-based browser (Chrome, Edge, Brave, Opera) was enough to compromise the target system.
The exploit leveraged CVE-2025-2783, a sandbox escape zero-day in Chrome. Google patched the vulnerability in version 134.0.6998.178, released on March 26, 2025. Mozilla later addressed the related flaw (CVE-2025-2857) in Firefox 136.0.4.
The Spyware Behind the Attack
Kaspersky’s continued analysis traced the malware used in ForumTroll back to 2022, uncovering connections to a commercial spyware family called “Dante” — developed by Memento Labs.
The company, formed from the remains of Hacking Team (famous for its RCS spyware scandal), now operates under new branding but appears to continue developing similar surveillance tools.
“We identified an unknown piece of malware called Dante, developed by the Italian company Memento Labs,” Kaspersky researchers wrote.
How It Works
- LeetAgent, a loader, was deployed in earlier attacks in Russia and Belarus.
- LeetAgent delivered Dante, a modular spyware capable of downloading additional payloads from C2 servers.
- Dante automatically self-deletes if it loses communication for a preset number of days — erasing all traces of its presence.
While Kaspersky attributed the spyware to Memento Labs, the researchers cautioned that the Chrome exploit itself may have been authored by a separate actor.
Implications and Mitigation
This campaign demonstrates a growing trend of commercial spyware vendors leveraging zero-days for geopolitical espionage.
Even though the initial operation focused on Eastern Europe, the same exploit could be repurposed globally by other threat actors.
Recommendations:
- ✅ Update Chrome to version 134.0.6998.178 or later.
- ✅ Update Firefox to version 136.0.4 or later.
- 🔍 Monitor for abnormal browser behavior or unknown outbound connections.
- 🧠 Review organizational exposure to commercial spyware threats.
- 🧱 Apply network-level restrictions to prevent C2 communications.
Alcaeus Services Insight
At Alcaeus Services, we monitor emerging zero-day and spyware ecosystems to help organizations:
- Detect browser exploit attempts
- Identify commercial surveillance malware
- Implement zero-trust network access and defensive EDR baselines across hybrid environments
The ForumTroll campaign underscores how commercial spyware vendors continue to evolve — blurring the line between state espionage and private surveillance.
