Chrome Zero-Day Actively Exploited in Attacks by Mem3nt0 mori

A critical zero-day flaw (CVE-2025-2783) in Google Chrome was actively exploited in "Operation ForumTroll" by the Mem3nt0 mori APT, targeting financial institutions, universities, and government agencies in Russia and Belarus. The campaign leveraged sophisticated spyware, including the Dante platform developed by Italian vendor Memento Labs, marking its first observed use in the wild. While Google has patched the vulnerability, this incident highlights the escalating cybersecurity risks posed by commercial surveillance tools and the persistent overlap between state-aligned espionage and the global spyware market, which is a significant concern for institutional security and geopolitical stability.

Analysis

A critical zero-day vulnerability (CVE-2025-2783) in Google Chrome was actively exploited in "Operation ForumTroll" starting March 2025, targeting financial institutions, universities, and government agencies in Russia and Belarus. This sophisticated campaign, attributed to Mem3nt0 mori APT, leveraged a sandbox escape exploit due to a logical oversight in Windows' pseudo-handle handling, allowing remote code execution. Google (GOOGL, GOOG) swiftly addressed the flaw in Chrome version 134.0.6998.177/.178.

The attackers deployed advanced spyware, including LeetAgent and the Dante platform developed by Italian vendor Memento Labs, marking the first observed in-the-wild use of this commercial surveillance tool. This highlights the increasing sophistication and accessibility of such capabilities, enabling remote command execution and sensitive file exfiltration.

The strongly negative sentiment (-0.6) and cautious tone reflect significant cybersecurity risks, particularly for institutions operating in sensitive geopolitical regions or handling critical data. The incident underscores the persistent overlap between state-aligned espionage and the global commercial spyware market, presenting a material concern for institutional security and data integrity.

Key Decisions for Investors

• Investors should prompt portfolio companies, especially those in critical infrastructure or finance, to conduct immediate audits of their cybersecurity defenses, focusing on browser and OS patch management and advanced threat detection.
• Evaluate exposure to third-party software and commercial spyware vendors within portfolio companies' supply chains, considering the implications of tools like Dante being weaponized in state-aligned operations.
• Integrate enhanced geopolitical risk assessments into investment models, recognizing that cyber espionage campaigns can significantly impact operational continuity and data security for companies with global footprints or sensitive data.