ForumTroll targets political scientists | Kaspersky official blog
Source Kaspersky Security Blog
Description
The ForumTroll APT group is sending malicious emails to political scientists, imitating reports of plagiarism.
Impact
For European organizations, especially academic and research institutions involved in political science, international relations, or global economics, this threat poses a significant risk of espionage and intellectual property theft. Successful compromise could lead to unauthorized remote access, data exfiltration, and manipulation of sensitive research data. The use of personalized social engineering tactics increases the likelihood of successful infection among targeted individuals. Persistent access via COM hijacking complicates detection and remediation efforts. Although the campaign currently targets Russian institutions, the tactics and malware framework could be adapted to target European researchers, potentially impacting confidentiality and integrity of sensitive political research. The attack could also undermine trust in academic communications and electronic libraries. Additionally, if attackers pivot from compromised machines, they could threaten broader organizational networks. The medium severity reflects the targeted nature and requirement for user interaction but acknowledges the potential for significant damage if successful.
Defensive guidance
European organizations should implement multi-layered defenses tailored to targeted spear-phishing threats. Specifically, deploy advanced email security gateways capable of detecting and blocking spoofed domains and malicious attachments, including .lnk files and archives with embedded scripts. Enforce strict attachment filtering policies and disable execution of PowerShell scripts from email downloads unless explicitly required and monitored. Employ endpoint detection and response (EDR) solutions with behavioral analysis to identify and quarantine suspicious activities such as COM hijacking and unauthorized remote access framework installations. Conduct targeted user awareness training for researchers and staff on recognizing spear-phishing attempts, especially those involving personalized content and academic themes like plagiarism reports. Regularly audit and restrict PowerShell usage and script execution policies on endpoints. Maintain up-to-date threat intelligence feeds to detect emerging APT tactics and indicators of compromise related to ForumTroll. Finally, implement network segmentation to limit lateral movement from compromised hosts and ensure robust incident response plans are in place to quickly isolate and remediate infections.