Kaspersky GReAT experts have for the first time discovered the use of spyware created by the Italian company Memento Labs (formerly HackingTeam) in real attacks. It was possible to track the malware's activity thanks to the analysis of Operation Forum Troll, aimed at employees of Russian organizations. The researchers reported this at the Security Analyst Summit 2025 in Thailand.
Hacking Team is one of the oldest spyware manufacturers. The company was founded in 2003 and was engaged in the development and sale of "legal" surveillance software. She became famous because of the spyware Remote Control Systems (RCS), which was used by government agencies around the world. After hacking in 2015, 400 GB of the Hacking Team's internal documents got online, and in 2019 it was bought by the InTheCyber Group and renamed Memento Labs. Four years later, the company announced a new Dante spyware. However, so far the malware has not been encountered in real attacks, and little was known about its capabilities.
Operation "Forum troll" and traces of spyware. In March 2025, Kaspersky Lab discovered a sophisticated targeted campaign that exploited a zero-day vulnerability in Chrome. The attackers sent personalized phishing emails to employees of the media, government, educational and financial institutions in Russia with an offer to participate in the Primakov Readings scientific and expert forum. If the victim clicked on the link and opened the Chrome browser, the device was immediately infected. No other actions were required from the user.
The LeetAgent spyware was used in the "Forum Troll" operation. All commands were written in Leet, which is rare in malware for complex targeted attacks. Kaspersky Lab experts traced LeetAgent's activity to 2022 and identified other attacks by the same group targeting organizations and individuals in Russia and Belarus. While studying the attackers' arsenal, they discovered a previously unknown malware and came to the conclusion that it was commercial Dante spyware developed by the Italian company Memento Labs (formerly Hacking Team). The analysis showed that similar code is present in Dante and some of the tools used in Operation Forum Troll, indicating that these tools were also developed by Memento Labs.
"The creators of spyware are well known to cybersecurity experts. However, malware can be difficult to identify and assign to a specific group, especially in the case of targeted attacks. To determine the origin of Dante, we had to sort through several layers of confusing code, track down obvious signs of its use over several years and compare it with possible creators. It seems that the malware developers chose the name Dante for a reason, because anyone who is trying to figure out its origin has a difficult path ahead," comments Boris Larin, a leading Kaspersky GReAT expert.
Please note that this press release is based on materials provided by the company. AK&M Information Agency shall not be held liable for its contents, nor for the legal and other consequences of its publication.
