Threats Tagged 'dante'

The ForumTroll APT group has launched a new targeted phishing campaign against Russian political scientists, exploiting plagiarism reports as bait. The attackers used sophisticated techniques, including a well-prepared domain and personalized emails, to deliver the Tuoni framework malware. This campaign follows their spring attacks, which targeted organizations using zero-day vulnerabilities. The fall campaign relied on social engineering, using emails posing as a scientific library to trick victims into downloading malicious archives. The final payload was delivered through a PowerShell script and established persistence using COM Hijacking. Despite being less technically sophisticated than the spring campaign, this operation demonstrates the group's continued focus on Russian and Belarusian targets.

MediumCampaignRussiaBelarusUkraine+6#com hijacking#plagiarism bait#tuoni framework

Team46, previously known as TaxOff, is an advanced persistent threat (APT) group employing sophisticated malware and attack techniques to maintain long-term persistence in targeted systems. Their operations include the use of zero-day exploits such as CVE-2024-6473 and CVE-2025-2783, advanced backdoors like Trinper with multiple encryption layers, and auxiliary reconnaissance tools. The group leverages phishing campaigns, DLL hijacking, PowerShell commands, and Cobalt Strike beacons to infiltrate and control victim networks. Their infrastructure mimics legitimate services to evade detection. Although no known exploits are currently widespread in the wild, the threat poses a medium severity risk due to its complexity and stealth. European organizations, especially those in critical infrastructure and government sectors, face significant risks from this threat. Mitigation requires targeted detection of indicators of compromise, strict PowerShell logging, and enhanced email security measures. Countries with high adoption of affected technologies and strategic geopolitical relevance are more likely to be targeted.

MediumMalwareGermanyFranceItaly+7#trinper#cobalt strike#dante