Memento Labs, the ghost of Hacking Team, has returned — or maybe it was never gone at all.

Memento Labs, the group framed as the ghost of Hacking Team, is described as returning, or perhaps never having gone away, with connections drawn to its commercial spyware “Dante” and its attribution to former Hacking Team tooling. According to Kaspersky, the first Chrome zero-day of 2025, CVE-2025-2783, was linked to the same tools seen in Dante and tied to a state-sponsored cyber-espionage campaign linked to Memento Labs via Operation ForumTroll.

The ForumTroll campaigns used spear-phishing and short-lived links, targeting Russian and Belarusian media, research, and government entities, and researchers traced these activities back to two clusters employing LeetAgent spyware and a more advanced commercial implant. Kaspersky notes that the Dante spyware underwent heavy obfuscation and anti-analysis checks, with an orchestrator that decrypts and loads AES-encrypted modules and communicates with HTTPS C2 servers.

The article also mentions a related Chrome sandbox-escape flaw exploited in March 2025 and discusses persistence via COM hijacking to load malicious DLLs into system processes and browsers. The overall narrative, supported by the cited report, suggests the attribution of ForumTroll tools to Memento Labs, formerly Hacking Team, and notes ongoing concerns about its evolution.