ForumTroll, an advanced persistent threat (APT) group, has launched a new targeted phishing campaign against Russian political scientists, exploiting the theme of plagiarism reports to lure victims. The attackers registered and used a well-prepared domain, e-library.wiki, to impersonate a scientific library, sending personalized emails containing malicious archives. Upon execution, these archives deploy the Tuoni malware framework via PowerShell scripts, a technique that allows attackers to run code without dropping traditional executable files, thereby evading some detection methods. Persistence is established through COM Hijacking, a method where attackers manipulate Component Object Model registrations to ensure malware execution on system startup or specific triggers. This campaign follows a more sophisticated spring campaign by the same group that leveraged zero-day vulnerabilities, but the fall campaign relies heavily on social engineering and targeted phishing. The malware suite includes components such as Dante and LeetAgent, indicating modular capabilities for espionage and data exfiltration. The campaign's tactics align with MITRE ATT&CK techniques including T1566 (Phishing), T1059.001 (PowerShell), T1547.001 (COM Hijacking), and T1105 (Ingress Tool Transfer). Indicators of compromise include the IP address 193.65.18.14 and the domain e-library.wiki. No CVEs or known exploits in the wild are reported for this campaign, and the threat actor continues to focus on Russian and Belarusian targets, suggesting geopolitical motivations. The campaign's medium severity reflects the targeted nature and reliance on social engineering rather than widespread technical exploits.

For European organizations, the direct impact of this campaign is limited due to its focus on Russian and Belarusian political scientists. However, European entities involved in political science, international relations, or research collaborations with Russian or Belarusian institutions could be indirectly affected, especially if targeted by similar phishing tactics or if their networks have connections to the targeted individuals. The use of sophisticated social engineering and persistence mechanisms like COM Hijacking could lead to unauthorized access, espionage, and data theft, compromising confidentiality and integrity. Additionally, the presence of PowerShell-based malware increases the risk of lateral movement within networks if initial compromise occurs. The campaign highlights the risk of targeted phishing attacks exploiting topical themes relevant to the victim's professional interests, which could be adapted against European targets in the future. Organizations with geopolitical or research interests in Eastern Europe should be particularly vigilant. The medium severity indicates a moderate risk level, emphasizing the need for awareness and targeted defenses rather than emergency patching or incident response.

1. Implement advanced email filtering solutions that detect and quarantine phishing emails, especially those with suspicious attachments or links related to scientific or academic themes. 2. Conduct targeted security awareness training for employees, focusing on recognizing social engineering tactics such as personalized phishing emails exploiting topical bait like plagiarism reports. 3. Monitor and restrict PowerShell usage through application whitelisting and logging to detect anomalous script execution indicative of malware deployment. 4. Employ Endpoint Detection and Response (EDR) tools capable of identifying persistence techniques like COM Hijacking and unusual COM object registrations. 5. Regularly audit and harden COM registrations and system startup entries to prevent unauthorized modifications. 6. Block and monitor network traffic to and from known malicious domains and IP addresses, including e-library.wiki and 193.65.18.14. 7. Establish incident response playbooks tailored to phishing and PowerShell-based malware infections to enable rapid containment and remediation. 8. Collaborate with threat intelligence providers to stay updated on ForumTroll activities and indicators of compromise. 9. Limit user privileges to reduce the impact of successful phishing attacks and prevent unauthorized persistence mechanisms. 10. For organizations with ties to Russian or Belarusian research communities, implement additional scrutiny and monitoring of communications and file exchanges.