MEM3NT0 MORI – THE HACKING TEAM IS BACK!

Summary from the TLDR InfoSec newsletter

Kaspersky uncovered Operation ForumTroll, a sophisticated espionage campaign using personalized phishing emails that exploit CVE-2025-2783, a Chrome sandbox escape vulnerability affecting Windows Inter-Process Communication (IPC) pseudo handles. The operation deployed "Dante" spyware by Memento Labs, targeting Russian entities through zero-day exploits and evasion techniques such as WebGPU validation and COM hijacking. Security teams should monitor for Base64 folders in %LocalAppData%, enhance email filtering for personalized phishing, and update Chrome to version 134.0.6998.177/178 or later to mitigate the sandbox vulnerability.