Chrome Zero-Day Exploited to Deliver Italian Memento Labs' LeetAgent Spyware

Kaspersky has revealed that a zero-day Google Chrome vulnerability (CVE-2025-2783) was exploited in 'Operation ForumTroll' to deploy espionage tools, including the newly identified LeetAgent spyware, developed by Italian firm Memento Labs. The campaign specifically targeted financial institutions, government bodies, and other critical organizations in Russia and Belarus. Memento Labs' CEO confirmed the spyware's origin, attributing its use to an unnamed government customer, underscoring the significant cybersecurity risks and accountability challenges associated with the proliferation and potential misuse of commercial surveillance technology within the global threat landscape.

Analysis

A critical zero-day vulnerability, CVE-2025-2783, in Google Chrome was actively exploited in "Operation ForumTroll" to deploy espionage tools, including the newly identified LeetAgent spyware. This targeted spear-phishing campaign specifically aimed at media outlets, universities, government organizations, and financial institutions in Russia and Belarus. The exploitation allowed attackers to bypass Chrome's sandbox and deliver sophisticated malware, indicating a high level of threat actor capability.

The spyware, LeetAgent and the more advanced Dante, was developed by Italian firm Memento Labs, a company with a history rooted in HackingTeam, known for selling offensive intrusion capabilities to governments. Memento Labs' CEO confirmed the spyware's origin, attributing its use to an unnamed government customer who utilized an outdated Windows version of Dante. This incident underscores the significant risks associated with the proliferation and potential misuse of commercial surveillance technology.

While Memento Labs claims to now focus on mobile platforms and has requested customers cease using Windows malware, the event highlights a persistent challenge in cybersecurity and corporate accountability. The strongly negative general sentiment (-0.7) and negative per-ticker sentiment for GOOGL/GOOG (-0.4) reflect concerns over browser security and the broader implications for digital trust. This situation could prompt increased scrutiny on software vendors and their government clients regarding ethical use and oversight, potentially leading to regulatory or legal ramifications.

Key Decisions for Investors

• Investors should assess the cybersecurity posture and supply chain risks of their portfolio companies, particularly those operating in sensitive sectors or geographies, given the increasing sophistication and commercial availability of state-sponsored and commercial spyware.
• Monitor regulatory developments and potential legislative actions concerning the sale and use of commercial surveillance technologies, as these could impact technology vendors and government contractors.
• Evaluate Google's ongoing investments in browser security, incident response, and transparency, as repeated high-profile vulnerabilities could impact user trust, enterprise adoption of its ecosystem, and potentially lead to reputational damage or regulatory fines.