Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareUsed by 2 actorsExploits 1 CVE

LeetAgent

LeetAgent is a modular spyware/backdoor used in the Operation ForumTroll espionage campaign and traced in related activity since at least 2022. It was delivered in March 2025 via highly targeted phishing emails that led victims in Russia and Belarus to malicious sites exploiting the Google Chrome sandbox escape zero-day CVE-2025-2783; victims were infected by visiting the site with Chrome or another Chromium-based browser. Kaspersky reported the campaign targeted media outlets, universities, research centers, government organizations, financial institutions, and other organizations, with the apparent objective of espionage.

LeetAgent communicates with command-and-control servers over HTTPS and supports a broad remote administration and surveillance feature set. Reported capabilities include command execution, process execution, task management, stopping tasks, shellcode injection, file read/write operations, directory changes, configuration changes, termination, background keylogging, and file theft. It specifically searched for and stole common document formats including .doc, .xls, .ppt, .rtf, .pdf, .docx, .xlsx, and .pptx. Its command scheme is notable for using leetspeak-coded commands, which is the basis for its name. Its configuration and communications were described as obfuscated, and reporting noted use of multiple C2 servers and traffic obfuscation.

In the observed intrusion chain, a malicious DLL loader decrypted and launched LeetAgent. The loader used OLLVM obfuscation, could bind encrypted malware to the infected machine using the BIOS UUID, activated only in selected processes including rdpclip.exe, and used Donut-generated shellcode to launch the payload. Persistence in the broader ForumTroll chain was achieved through COM hijacking by overriding the CLSID for twinapi.dll {AA509086-5Ca9-4C25-8F95-589D3C07B48A} in the user registry hive. Attackers were reported to use Fastly-hosted infrastructure in many cases for LeetAgent C2 and delivery of additional tools such as 7z, Rclone, and SharpChrome.

LeetAgent is closely associated with the more advanced Dante spyware platform and has at times acted as a loader for Dante. Multiple reports state that the tooling is linked to or attributed with high confidence to Memento Labs, the Italian company formerly known as Hacking Team, based on code and operational overlaps with Dante and legacy Hacking Team RCS lineage. The threat actor operating the campaign is tracked by Kaspersky as ForumTroll; however, some reporting notes that the ultimate operator or commissioner of the operations remains unknown.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2025-2783Google Chrome Mojo sandbox escape on WindowsExploited in the wild

LeetAgent is the spyware used in the Operation ForumTroll campaign. We named it LeetAgent because all of its commands are written in leetspeak.

via securelistsecurelist.com
THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
forumtroll_apt

LeetAgent is the spyware used in the Operation ForumTroll campaign. We named it LeetAgent because all of its commands are written in leetspeak.

via securelistsecurelist.com
Hacking Team

A zero-day vulnerability in Google Chrome, identified as CVE-2025-2783, was recently exploited in the wild to deliver the LeetAgent spyware. This…

via secpod blogsecpod.com
MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1189Drive-by CompromiseEvidence1

No further action was required to initiate the infection; simply visiting the malicious website using Google Chrome or another Chromium-based web browser was enough.

T1566.002Spearphishing LinkEvidence1

In all known cases, infection occurred after the victim clicked a link in a spear phishing email that directed them to a malicious website.

Execution

2 techniques
T1059.003Windows Command ShellEvidence1

0xC033A4D (COMMAND) – Run command with cmd.exe

T1203Exploitation for Client ExecutionEvidence1

Following the timeline of events and the infection logic, this next stage should have been a remote code execution (RCE) exploit for Google Chrome...

Privilege Escalation

2 techniques
T1055Process InjectionEvidence1

0x1213C7 (INJECT) – Inject shellcode

T1068Exploitation for Privilege EscalationEvidence1

Kaspersky’s technologies successfully identified a sophisticated zero-day exploit that was used to escape Google Chrome’s sandbox... fixed it as CVE-2025-2783.

Stealth

1 technique
T1055Process InjectionEvidence1

0x1213C7 (INJECT) – Inject shellcode

Credential Access

1 technique
T1056.001KeyloggingEvidence1

In addition to executing commands received from its C2, it runs keylogging and file-stealing tasks in the background.

Collection

2 techniques
T1005Data from Local SystemEvidence1

By default, the file-stealer task searches for documents with the following extensions: *.doc, *.xls, *.ppt, *.rtf, *.pdf, *.docx, *.xlsx, *.pptx.

T1056.001KeyloggingEvidence1

In addition to executing commands received from its C2, it runs keylogging and file-stealing tasks in the background.

Command and Control

2 techniques
T1071.001Web ProtocolsEvidence1

The malware connects to one of its C2 servers specified in the configuration and uses HTTPS to receive and execute commands

T1105Ingress Tool TransferEvidence1

Attackers frequently use it to download and run additional tools such as 7z, Rclone, SharpChrome, etc., as well as additional malware

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.sha256●●●●●●●●●●●●View more in app8 months ago
hash.md5●●●●●●●●●●●●View more in app8 months ago
hash.sha1●●●●●●●●●●●●View more in app8 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.