CEO of spyware maker Memento Labs confirms one of its government customers was caught using its malware

On Monday, researchers at cybersecurity large Kaspersky published a report figuring out a brand new adware known as Dante that they are saying focused Home windows victims in Russia and neighboring Belarus. The researchers mentioned the Dante adware is made by Memento Labs, a Milan-based surveillance tech maker that was fashioned in 2019 after a new owner acquired and took over early adware maker Hacking Staff.

Memento chief govt Paolo Lezzi confirmed to TechCrunch that the adware caught by Kaspersky does certainly belong to Memento.

In a name, Lezzi blamed one of many firm’s authorities clients for exposing Dante, saying the client used an outdated model of the Home windows adware that may not be supported by Memento by the top of this 12 months. 

“Clearly they used an agent that was already lifeless,” Lezzi informed TechCrunch, referring to an “agent” because the technical phrase for the spyware planted on the goal’s pc.

“I assumed [the government customer] didn’t even use it anymore,” mentioned Lezzi. 

Lezzi, who mentioned he was unsure which of the corporate’s clients had been caught, added that Memento had already requested that each one of its clients cease utilizing the Home windows malware. Lezzi mentioned the corporate had warned clients that Kaspersky had detected Dante adware infections since December 2024. He added that Memento plans to ship a message to all its clients on Wednesday asking them as soon as once more to cease utilizing its Home windows adware.

He additionally mentioned that Memento presently solely develops adware for cellular platforms. The corporate additionally develops some zero-days — that means safety flaws in software program unknown to the seller that can be utilized to ship adware — although, the corporate principally sources its exploits from outdoors builders, in line with Lezzi. 

When reached by TechCrunch, Kaspersky spokesperson Mai Al Akka wouldn’t say which authorities Kaspersky believes is behind the espionage marketing campaign, however that it was “somebody who has been ready to make use of Dante software program.”

“The group stands out for its sturdy command of Russian and information of native nuances, traits that Kaspersky noticed in different campaigns linked to this [government-backed] risk. Nevertheless, occasional errors recommend that the attackers weren’t native audio system,” Al Akka informed TechCrunch.

In its new report, Kaspersky mentioned it discovered a hacking group utilizing the Dante adware that it refers to as “ForumTroll,” describing the concentrating on of individuals with invitations to Russian politics and economics discussion board Primakov Readings. Kaspersky mentioned the hackers focused a broad vary of industries in Russia, together with media shops, universities, and authorities organizations. 

Kaspersky’s discovery of Dante got here after the Russian cybersecurity agency mentioned it detected a “wave” of cyberattacks with phishing hyperlinks that had been exploiting a zero-day within the Chrome browser. Lezzi mentioned that the Chrome zero-day was not developed by Memento. 

In its report, Kaspersky researchers concluded that Memento “stored enhancing” the adware initially developed by Hacking Staff till 2022, when the adware was “changed by Dante.” 

Lezzi conceded that it’s potential that some “features” or “behaviors” of Memento’s Home windows adware had been left over from adware developed by Hacking Staff.

A telltale signal that the adware caught by Kaspersky belonged to Memento was that the builders allegedly left the phrase “DANTEMARKER” within the adware’s code, a transparent reference to the identify Dante, which Memento had beforehand and publicly disclosed at a surveillance tech convention, per Kaspersky. 

Very like Memento’s Dante adware, some variations of Hacking Staff’s adware, codenamed Distant Management System, had been named after historic Italian figures, corresponding to Leonardo Da Vinci and Galileo Galilei.

A historical past of hacks

In 2019, Lezzi bought Hacking Staff and rebranded it to Memento Labs. Based on Lezzi, he paid just one euro for the corporate and the plan was to start out over. 

“We need to change completely every part,” the Memento proprietor told Motherboard after the acquisition in 2019. “We’re ranging from scratch.”

A 12 months later, Hacking Staff’s CEO and founder David Vincenzetti announced that Hacking Team was “lifeless.”

When he acquired Hacking Staff, Lezzi informed TechCrunch that the corporate solely had three authorities clients remaining, a far cry from the greater than 40 authorities clients that Hacking Staff had in 2015. That very same 12 months, a hacktivist known as Phineas Fisher broke into the startup’s servers and siphoned off some 400 gigabytes of inner emails, contracts, paperwork, and the supply code for its adware.

Earlier than the hack, Hacking Staff’s clients in Ethiopia, Morocco, and the United Arab Emirates had been caught concentrating on journalists, critics, and dissidents utilizing the corporate’s adware. As soon as Phineas Fisher revealed the corporate’s inner information on-line, journalists revealed {that a} Mexican regional authorities used Hacking Staff’s adware to focus on native politicians, and that Hacking Staff had bought to international locations with human rights abuses, together with Bangladesh, Saudi Arabia, and Sudan, amongst others.

Lezzi declined to inform TechCrunch what number of clients Memento presently has, however implied it was fewer than 100 clients. He additionally mentioned that there are solely two present Memento workers left from Hacking Staff’s former workers.

The invention of Memento’s adware exhibits that one of these surveillance know-how retains proliferating, in line with John Scott-Railton, a senior researcher who has investigated adware abuses for a decade on the College of Toronto’s Citizen Lab. It additionally exhibits

Additionally {that a} controversial firm can die due to a spectacular hack and a number of other scandals, and but a brand new firm with model new adware can nonetheless come out of its ashes, 

“It tells us that we have to sustain the worry of penalties,” Scott-Railton informed TechCrunch. “It says so much that echoes of probably the most radioactive, embarrassed and hacked model are nonetheless round.”