TaxOff Strikes with Zero-Day Attack on Chrome, Unleashes Trinper Backdoor

Key facts

• The flaw: TaxOff exploited CVE-2025-2783, a Google Chrome sandbox escape, as a zero-day in mid-March 2025.
• The payload: The exploit installed Trinper, a C++ backdoor the group uses for espionage.
• Who was hit: Positive Technologies says TaxOff has targeted Russian government organizations, and the Chrome campaign used invitations to the Primakov Readings forum as bait.
• The fix: Google patched the flaw on March 25, 2025, in Chrome 134.0.6998.177/.178.
• Attribution: Kaspersky first documented the attacks as Operation ForumTroll; Positive Technologies later tied them to TaxOff.

How the attack started

Positive Technologies researchers say a Chrome zero-day used in March 2025 was the work of TaxOff, a group the company first described in late 2024 after a series of attacks on Russian government agencies. The flaw, CVE-2025-2783, let attackers break out of Chrome’s sandbox. Victims got a phishing email with a personalized link, and clicking it was enough to install the Trinper backdoor.

Inside CVE-2025-2783

Kaspersky, which found the exploit and reported it to Google, called the bug a logic error at the point where Chrome’s sandbox meets the Windows operating system. Its researchers said the exploit let attackers bypass the sandbox “as if it didn’t even exist” without doing anything obviously malicious. Google rated the flaw high severity (CVSS 8.3).

The email lures were disguised as invitations to the Primakov Readings, a foreign-policy forum, and the links led to a fake site that hosted the exploit. Each link was personalized and short-lived.

Who found it

Kaspersky’s exploit detection flagged the infections in mid-March 2025. Its researchers reverse-engineered the exploit, confirmed it worked against the latest Chrome release and reported it to Google. Positive Technologies then linked the follow-on infection chain to TaxOff.

What Trinper does once installed

Positive Technologies describes Trinper as a multithreaded backdoor written in C++. It collects information about the host, records keystrokes, gathers documents (.doc, .xls, .ppt, .rtf and .pdf files) and sends them to a command server. The operators can also read and write files, run commands through cmd.exe and open a reverse shell.

Because it runs many tasks in parallel, the backdoor can keep stealing data and pulling in new modules without slowing the machine down enough to be noticed.

Google’s patch

Google fixed the flaw on March 25, 2025, after Kaspersky’s report. Chrome updates itself, but users who keep the browser open for days should restart it to load the fix, and administrators should check that managed installs are on 134.0.6998.177/.178 or later.

TaxOff and Team46

In June 2025 Positive Technologies said TaxOff is probably the same group as Team46, which had earlier exploited a Yandex Browser DLL hijacking flaw (CVE-2024-6473). The two share loaders, phishing tactics and infrastructure that mimics legitimate services.

The researchers noted that a group willing to burn browser zero-days on targeted phishing is planning for long-term access, not a quick payday.

What defenders should check

The attack needed just one click on a convincing invitation. For defenders, that means two practical checks: confirm browsers are patched and restarted, and treat unexpected event invitations from unfamiliar senders with suspicion even when they look official.

For organizations in the sectors TaxOff targets, hunting for the loader and backdoor indicators published by Positive Technologies and Kaspersky is a sensible next step.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.