Italian spyware vendor linked to Chrome zero-day attacks – Against Invaders – Notícias de CyberSecurity para humanos.

attack chain used in Operation ForumTroll, saying that the malware used in the campaign dates back to at least 2022 and led to the discovery of other attacks on organizations in Russia and Belarus.

Analyzing the old attacks, the researchers found “an unknown piece of malware that we identified as commercial spyware called “Dante” and developed by the Italian company Memento Labs.”

Memento Labs is the name of a new company built on the research and expertise of the former ‘Hacking Team,’ a Milan-based spyware vendor previously known for its Remote Control System (RCS) sold to authorities as a surveillance tool.

Hacking Team was breached in 2015, and the incident sealed the company’s fate as it revealed sales to authoritarian regimes, access to zero-day exploits, and interaction with government intelligence clients.

In2019, the firm was acquired by InTheCyber Group, which used Hacking Team’s assets to form Memento Labs.

Four years later, at the ISS World Middle East and Africa conference, Memento Labs presented its new Dante spyware, although the details remained private.

LeetAgent and Dante

Operation ForumTroll attacks start with a phishing email with a personalized, short-lived link to the malicious site, where a validator script filters visitors to make sure that only targets of interest are compromised.

On the next step, the attackers exploited CVE-2025-2783 to achieve shellcode execution on the victim’s browser process and install a persistent loader to inject a malicious DLL.

The DLL decryptedthe main payload called LeetAgent, a modular spyware that supports command execution, file operations, keylogging,and data theft.

Kaspersky researchers notethat LeetAgent is unique for its use of leetspeak in command implementation, and believe that it might also be a commercial spyware tool.