Loading threat actor…
Hacking Team, later rebranded as Memento Labs after acquisition by InTheCyber Group in 2019, is an Italian commercial spyware vendor founded in 2003 and best known for its Remote Control System (RCS), also referred to as Da Vinci. The company sold surveillance capabilities to governments and government agencies and remained active after its 2015 breach, with later malware development attributed to its own developers. Known aliases include Memento Labs and Memento Labs (formerly Hacking Team). Its tooling has supported targeted surveillance and cyber-espionage operations against government and private-sector entities. Historical and later-generation implants have included capabilities for keylogging, credential and password theft, file theft, screenshot capture, camera and microphone activation, geolocation, command execution, process and shellcode execution, and modular tasking. Post-breach RCS samples retained a staged architecture using Scout and Soldier or Elite components. More recent operations have been linked to the Dante spyware platform and the LeetAgent implant, which have been associated with campaigns targeting organizations in Russia and Belarus since at least 2022. Hacking Team and its successor tooling have been delivered through spearphishing and exploit-based intrusion chains, including malicious documents and browser exploitation. Reporting links Memento Labs tooling to Operation ForumTroll, a state-sponsored espionage campaign that exploited CVE-2025-2783 and used LeetAgent, with related activity also involving Dante. Observed tradecraft includes persistence via COM hijacking, obfuscation and packing with VMProtect and MPRESS, anti-analysis and anti-sandbox checks, self-removal logic, and use of modular loaders and orchestrators. LeetAgent has been described as supporting command execution, keylogging, file theft, and code injection, while Dante appears to be an evolution of RCS emphasizing evasion, modularity, and operational security. The company’s leaked codebase has also had broader ecosystem impact: source code from its Vector-EDK UEFI bootkit and other components has been reused by unrelated threat actors. Hacking Team has additionally been linked historically to targeted spyware deployment against civil society figures, including Ahmed Mansoor in 2012. Overall, Hacking Team/Memento Labs is best characterized as a commercial spyware developer whose products have been used in high-end surveillance and espionage operations rather than as a conventional financially motivated cybercriminal group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
40 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
11 malware families attributed to this actor across reporting.
6 additional families tracked in Mallory.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
The malicious sites, in turn, exploited known exploits, designated as CVE-2012-2825 and CVE-2012-2871, and are present in the default browsers found in Android versions from 4.0 to 4.3.
The malicious sites, in turn, exploited known exploits, designated as CVE-2012-2825 and CVE-2012-2871, and are present in the default browsers found in Android versions from 4.0 to 4.3.
A zero-day vulnerability in Google Chrome, identified as CVE-2025-2783, was recently exploited in the wild to deliver the LeetAgent spyware.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Memento Labs (formerly Hacking Team) is known for developing and selling offensive cyber tools, often to government clients.
Memento Labs, successor to HackingTeam, is involved in offensive cyber operations targeting a wide range of organizations in Belarus and Russia. It uses its Dante spyware platform to deploy exploits and the LeetAgent implant for surveillance and data exfiltration.
Hacking Team (now Memento Labs) is known for developing and deploying commercial spyware, including LeetAgent and Dante, which feature advanced evasion, anti-analysis, and persistence capabilities. They have re-emerged with new malware campaigns.
Memento Labs is a threat actor formed from the remnants of Italian spyware vendor HackingTeam. It is known for conducting sophisticated cyber-espionage campaigns using its Dante spyware platform and LeetAgent implant, targeting a wide range of organizations in Belarus and Russia. The group employs advanced operational security, phishing with personalized lures, and zero-day exploits.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.