CEO of spyware maker Memento Labs confirms one of its government customers was caught using its malware

Cybersecurity firm Kaspersky identified "Dante" spyware, developed by Memento Labs (successor to the controversial Hacking Team), targeting Windows users in Russia and Belarus, including media and government organizations. Memento Labs confirmed the spyware's origin, attributing its detection to an outdated version used by a government client, and announced plans to cease Windows spyware development. This incident underscores the persistent proliferation and evolution of surveillance technology, despite past scandals, and its continued deployment by state actors.

Analysis

Cybersecurity firm Kaspersky recently identified "Dante" spyware, developed by Memento Labs, targeting Windows users in Russia and Belarus, including media, universities, and government organizations. Memento Labs, the successor to the controversial Hacking Team, confirmed the spyware's origin, attributing its detection to an outdated version utilized by a government customer. This incident highlights the continued deployment of sophisticated surveillance tools by state-backed actors.

Memento CEO Paolo Lezzi stated the company plans to cease support for Windows spyware by year-end and has already requested customers discontinue its use, shifting focus to mobile platforms. The company, acquired for a nominal €1 in 2019, operates with fewer than 100 customers and minimal former Hacking Team staff, indicating a niche, specialized business model. This strategic pivot suggests an attempt to mitigate reputational and operational risks associated with its legacy.

The discovery underscores the persistent proliferation and evolution of surveillance technology, even from entities with a history of controversy and human rights concerns. The targeting of critical sectors in Russia and Belarus by a group exhibiting strong Russian language command, yet with occasional errors, points to complex geopolitical dynamics and ongoing cyber espionage activities. This environment presents elevated cybersecurity risks for organizations globally.

Key Decisions for Investors

• Monitor the evolving regulatory landscape concerning surveillance technology and its developers, as increased scrutiny could impact companies operating in this sensitive sector.
• Assess cybersecurity postures of portfolio companies, particularly those operating in geopolitically sensitive regions or critical infrastructure, given the persistent threat of advanced persistent threats (APTs) and state-sponsored espionage.
• Evaluate supply chain risks related to software and hardware vendors, considering the potential for embedded vulnerabilities or state-sponsored backdoors, especially from less transparent providers.