Hacking Team
Memento Labs is an Italian commercial spyware vendor and the successor to Hacking Team, which was acquired by InTheCyber Group in 2019 and rebranded as Memento Labs. Known aliases in the provided content include Hacking Team and Memento Labs (formerly Hacking Team). Hacking Team was previously known for its Remote Control Systems (RCS), also referred to as Da Vinci. The content links Memento Labs to spyware operations targeting organizations in Russia and Belarus, including media outlets, universities, research centers, government organizations, financial institutions, and other private- and public-sector entities. Kaspersky traced related activity back to at least 2022. The tooling described includes the Dante spyware platform and the LeetAgent implant. LeetAgent is described as supporting command execution, process and task execution, shellcode injection, file read/write and theft, and keylogging, with HTTPS command-and-control communications and obfuscated configuration/traffic; some infrastructure was hosted via Fastly.net. Dante is described as a more advanced modular spyware platform with an orchestrator for module loading and management, HTTPS C2, anti-analysis and anti-debugging protections, VMProtect obfuscation, self-protection, and self-deletion or self-removal if command-and-control is unreachable. The content states that Kaspersky attributed tools used in Operation ForumTroll to Memento Labs with high confidence based on code similarities with Hacking Team RCS, shared persistence mechanisms, and discovery of the Dante name in deobfuscated code. Operation ForumTroll exploited Chrome zero-day CVE-2025-2783 and targeted government and private-sector entities in Russia and Belarus; related reporting says the campaign was conducted by a nation-state threat group or state-sponsored APT using commercial spyware tools from Memento Labs. The content also notes that Kaspersky did not observe Dante directly used in Operation ForumTroll, but linked it to related attacks using the same toolset. Older Hacking Team activity in the content includes OS X malware delivered via exploit chains such as Flash and Word documents, with samples installing binaries into ~/Library/Preferences and newer versions packing the main backdoor module with MPRESS. The content also states that in 2012 Ahmed Mansoor’s laptop was infected with Hacking Team spyware delivered through a booby-trapped Microsoft Word document exploiting CVE-2010-3333. Other names referenced by external tracking in the content include Dante APT, TaxOff, and Team46.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
Associated vulnerabilities
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
The malicious sites, in turn, exploited known exploits, designated as CVE-2012-2825 and CVE-2012-2871, and are present in the default browsers found in Android versions from 4.0 to 4.3.
The malicious sites, in turn, exploited known exploits, designated as CVE-2012-2825 and CVE-2012-2871, and are present in the default browsers found in Android versions from 4.0 to 4.3.
A zero-day vulnerability in Google Chrome, identified as CVE-2025-2783, was recently exploited in the wild to deliver the LeetAgent spyware.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Memento Labs (formerly Hacking Team) is known for developing and selling offensive cyber tools, often to government clients.
Memento Labs, successor to HackingTeam, is involved in offensive cyber operations targeting a wide range of organizations in Belarus and Russia. It uses its Dante spyware platform to deploy exploits and the LeetAgent implant for surveillance and data exfiltration.
Hacking Team (now Memento Labs) is known for developing and deploying commercial spyware, including LeetAgent and Dante, which feature advanced evasion, anti-analysis, and persistence capabilities. They have re-emerged with new malware campaigns.
Memento Labs is a threat actor formed from the remnants of Italian spyware vendor HackingTeam. It is known for conducting sophisticated cyber-espionage campaigns using its Dante spyware platform and LeetAgent implant, targeting a wide range of organizations in Belarus and Russia. The group employs advanced operational security, phishing with personalized lures, and zero-day exploits.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.