Kaspersky Reveals Traces Of HackingTeam Successors Behind New Cyber Attacks

JAKARTA - Kaspersky's Global Research and Analysis Team (GREAT) has uncovered evidence linking HackingTeam's successor, Memento Labs, to a series of new cyberattacks.

This finding originated from an investigation into Operation ForumTroll, an Advanced Persistent Threat (APT) campaign that exploited zero-day vulnerabilities on Google Chrome in March.

At that time, this attack was revealed when the perpetrator sent a personal phishing email disguised as an invitation to the Primakov Readings forum, which targets Russian media, educational and financial institutions, to government organizations.

During the investigation, the researchers found that the attackers used spyware called Leetagent. In-depth analysis shows that this spyware has similarities to other more sophisticated surveillance devices, but is used in different attacks.

After studying further, Kaspersky discovered a relationship between Leetjent and another spyware named Dante, which turned out to be promoted by Memento Labs, the company that emerged after the disbandment of HackingTeam.

Dante's spyware uses high-level incognito techniques, such as VMProtect, to evade detection. This malware can also analyze the victim's computer environment before carrying out its action, so as not to be easily detected by the security system.

Kaspersky also found that the latest version of the HackingTeam's Remote Control System (RCS) spyware has many similarities with Dante, reinforcing the allegation that both were developed by the same party.

Furthermore, researchers are investigating that Leetagent has been in use since 2022, in attacks targeting organizations and individuals in Russia and Belarus.

The strike group, known as the APT ForumTroll, also shows good Russian language skills and understanding of the local context.

Kaspersky assessed that the relationship between Memento Labs, Leet Agent, and Dante shows how commercial surveillance technology continues to develop and is now being used in more covert and dangerous cyber espionage operations.