ForumTroll Phishing Campaign Targets Russian Scholars with eLibrary Lures

ForumTroll Phishing Attacks Targeting Russian Scholars

Operation ForumTroll, a sophisticated phishing campaign, is now targeting Russian academics and researchers, leveraging personalized emails that mimic legitimate communications from the eLibrary platform. These attacks, detected in October 2025, utilize a strategically aged domain and one-time-use download links to deliver malware.

Why This Matters

Current phishing detection relies heavily on identifying newly registered domains and generic email content; however, ForumTroll circumvents these defenses by using a domain registered months prior and highly personalized lures. This demonstrates a shift towards more sophisticated attacks requiring deeper behavioral analysis, as failing to detect these attacks can lead to compromise of sensitive research data and intellectual property – potentially costing institutions millions in remediation and reputational damage.

Key Insights

• Operation ForumTroll Origins: First observed targeting organizations in 2022, now focusing on individuals.
• Strategic Domain Aging: Attackers registered the malicious domain six months before the campaign launch to avoid detection.
• Tuoni C2 Framework: The final payload utilizes the Tuoni framework, enabling full remote access and control of compromised systems.

Working Example

# Example of checking domain age (using Python and whois) - for illustrative purposes only
import whois

domain = "e-library.wiki" # Malicious domain used in the attack
try:
    w = whois.whois(domain)
    creation_date = w.creation_date
    print(f"Domain creation date: {creation_date}")
except Exception as e:
    print(f"Error checking domain age: {e}")

Practical Applications

• University IT Departments: Implement enhanced email filtering and user training focused on recognizing personalized phishing attempts.
• Pitfall: Relying solely on blocklists of known malicious domains; ForumTroll demonstrates the effectiveness of using aged and seemingly legitimate domains.

References:

• https://thehackernews.com/2025/12/new-forumtroll-phishing-attacks-target.html