Skip to content
Install MCP

Threat actor

Memento Labs

Last fetched

Memento Labs is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

Memento Labs is a company that acquired the infamous spyware vendor Hacking Team, which sold its advanced surveillance technology, called Remote Control System (RCS), to governments and dictatorships worldwide. When researchers began to uncover information about Hacking Team’s operations, the primary targets were human rights activists and journalists. Hacking Team's former chairman, Paolo Lezzi, became the owner of Memento Labs and its parent company, InTheCyber. Memento Labs develops various snooping products, such as KRAIT, a surveillance tool that can silently infect any Android device without the target’s knowledge. It uses a "trusted implant" to appear as a legitimate source, making it easy to trick users into installing it. Once installed, KRAIT can steal passwords, monitor the device's location, microphone, camera, calls, and messages, all while hiding its activity through trusted online services. Another product, RCS X, is the latest version of a powerful spyware that has been used against journalists and human rights activists since 2012. It can infect almost any device, including macOS, Linux, Android, iOS, and BlackBerry, using security vulnerabilities. Once installed, RCS X allows hackers to control microphones, cameras, and take screenshots, while managing all infections from a single console. At a monitoring conference in Dubai, Memento Labs introduced two new tools: MoniTOR and PrevenTer. PrevenTer is designed for speech recognition and transcribing call recordings. MoniTOR is aimed at helping law enforcement track activities by attempting to exploit any technical vulnerabilities to bypass anonymization methods used by the Tor network. However, these tools were not developed by the company itself, it was developed via a research collaboration with the University of Applied Sciences and Arts of Southern Switzerland (SUPSI) and funded by the Swiss Agency for Innovation Promotion, Innosuisse. SUPSI and Memento Labs' parent company, In The Cyber, have contractual agreements to jointly develop software products.

Techniques by tactic

No ATT&CK techniques are recorded for Memento Labs in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to Memento Labs today — this states the absence of a published link, not that Memento Labs has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from Memento Labs into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.