Malware

Dante

According to Kaspersky Labs, Dante is the commercial spyware developed by Memento Labs (formerly Hacking Team).

Indicators of Compromise 15

Filename <DATE>_winscan_to_pdf.pdf.lnk Filename Baltic_Vector_2023.iso Filename DRIVE.GOOGLE.COM Filename Invitation_Russia-Belarus_strong_partnership_2024.lnk Filename Rostelecom.pdf.lnk Filename SCAN_XXXX_<DATE>.pdf.lnk MD5 33bb0678af6011481845d7ce9643cedc MD5 35869e8760928407d2789c7f115b7f83 MD5 7d3a30dbf4fd3edaf4dde35ccb5cf926 SHA-1 3650c1ac97bd5674e1e3bfa9b26008644edacfed SHA-1 8390e2ebdd0db5d1a950b2c9984a5f429805d48c SHA-1 c25275228c6da54cf578fa72c9f49697e5309694 SHA-256 07d272b607f082305ce7b1987bfa17dc967ab45c8cd89699bcdced34ea94e126 SHA-256 2e39800df1cafbebfa22b437744d80f1b38111b471fa3eb42f2214a5ac7e1f13 SHA-256 388a8af43039f5f16a0673a6e342fa6ae2402e63ba7569d20d9ba4894dc0ba59

MITRE ATT&CK TTPs 20

T1003
OS Credential Dumping
Credential Access
 T1012
Query Registry
Discovery
 T1021
Remote Services
Lateral Movement
 T1027
Obfuscated Files or Information
Defense Evasion
 T1048
Exfiltration Over Alternative Protocol
Exfiltration
 T1055
Process Injection
Defense Evasion
 T1057
Process Discovery
Discovery
 T1059.001
PowerShell
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1110
Brute Force
Credential Access
 T1204.002
Malicious File
Execution
 T1485
Data Destruction
Impact
 T1497
Virtualization/Sandbox Evasion
Defense Evasion
 T1498
Network Denial of Service
Impact
 T1547.001
Registry Run Keys / Startup Folder
Persistence

Source Articles

How we linked ForumTroll APT to Dante spyware by Memento Labs | Securelist
In March 2025, Kaspersky identified a sophisticated cyber espionage campaign dubbed Operation ForumTroll, targeting Russian and Belarusian organizations via spear phishing emails with personalized links. The attack exploited a zero-day vulnerability in Google Chrome (CVE-2025-2783) to escape the browser sandbox, leveraging a logical flaw in Windows IPC handling of pseudo-handles. The threat actor used LeetAgent, a custom spyware, and was linked to the commercial Dante spyware developed by Memento Labs (formerly Hacking Team), indicating a well-resourced and persistent threat actor conducting long-term surveillance operations.
Kaspersky-labs