How ForumTroll APT was linked to Dante spyware

Description

Kaspersky researchers uncovered a sophisticated attack campaign dubbed Operation ForumTroll, targeting organizations in Russia and Belarus. The campaign utilized a zero-day exploit (CVE-2025-2783) in Google Chrome to deliver spyware. Further investigation revealed connections to previously unknown commercial spyware called Dante, developed by Memento Labs (formerly Hacking Team). The researchers traced the malware back to 2022 and found similarities in code and tactics between the ForumTroll campaign and Dante spyware attacks. The discovery sheds light on the continued operations of the rebranded Hacking Team and their new surveillance tool.