Published on: 2025-10-29

Intelligence Report: Kaspersky Discovers Dante Spyware Made by Memento Labs Targeting Russia Belarus – International Business Times

1. BLUF (Bottom Line Up Front)

The discovery of the Dante spyware, attributed to Memento Labs, suggests a sophisticated espionage operation targeting Russia and Belarus. The most supported hypothesis is that Memento Labs, despite its claims, continues to develop and deploy spyware for governmental clients. Confidence in this assessment is moderate due to the complexity of attribution in cyber operations. Recommended action includes enhancing cybersecurity defenses and diplomatic engagement to address potential misuse of surveillance technology.

2. Competing Hypotheses

1. **Hypothesis A**: Memento Labs is actively developing and deploying Dante spyware for governmental clients, targeting Russia and Belarus.
– **Supporting Evidence**: Kaspersky’s findings of sophisticated spyware with markers linked to Memento Labs; historical context of Memento Labs’ predecessor, Hacking Team, in selling spyware to governments.
– **Contradictory Evidence**: Memento Labs’ CEO claims the spyware’s presence is due to client misuse, not company intent.

2. **Hypothesis B**: The spyware is a remnant of past operations by Hacking Team, and Memento Labs is not actively involved in current deployments.
– **Supporting Evidence**: Memento Labs’ assertion of client misuse and the presence of old code markers.
– **Contradictory Evidence**: Continued sophistication and updates in the spyware suggest active development.

3. Key Assumptions and Red Flags

– **Assumptions**:
– Memento Labs has the capability and intent to continue developing spyware.
– The presence of code markers directly links current spyware to Memento Labs.
– **Red Flags**:
– Memento Labs’ denial of involvement could be a strategic deception.
– Lack of direct evidence linking recent deployments to explicit orders from Memento Labs.
– **Blind Spots**:
– Potential third-party actors using the spyware without Memento Labs’ knowledge.

4. Implications and Strategic Risks

The use of Dante spyware in Russia and Belarus could escalate tensions, particularly if linked to foreign governments. It highlights vulnerabilities in regional cybersecurity and the potential for increased surveillance and control over political and economic activities. The situation could lead to retaliatory cyber actions or diplomatic conflicts.

5. Recommendations and Outlook

• Enhance cybersecurity measures in targeted regions to detect and mitigate spyware threats.
• Engage in diplomatic dialogue with Memento Labs and potentially affected governments to address concerns and prevent misuse.
• Scenario Projections:
  – **Best Case**: Memento Labs cooperates with international norms, reducing spyware deployment.
  – **Worst Case**: Escalation of cyber operations leads to broader geopolitical conflict.
  – **Most Likely**: Continued low-level espionage activities with occasional diplomatic tensions.

6. Key Individuals and Entities

– Paolo Lezzi (Memento Labs CEO)
– Kaspersky (Cybersecurity firm)
– Memento Labs (Italian surveillance technology firm)

7. Thematic Tags

national security threats, cybersecurity, counter-terrorism, regional focus