Memento

Memento, also known as Memento Team, is a financially motivated ransomware and extortion group documented in 2021. Its operations include exploiting CVE-2021-21972 in exposed VMware vCenter Server installations, stealing credentials, maintaining prolonged access, moving laterally, and exfiltrating data before deploying ransomware. In a documented intrusion, the group remained inside the victim network for more than five months and demanded approximately $1 million in Bitcoin while threatening to expose stolen data. The group uses Python-based ransomware packaged with PyInstaller. After endpoint protection disrupted an initial attempt to encrypt files directly, the operators modified their payloads to place victim files into password-protected WinRAR archives, encrypt the archive passwords, and delete the original files. This approach denied access to data while avoiding the direct file-encryption behavior detected by the victim's security controls. Memento's hands-on-keyboard operations use Impacket tools, including wmiexec and secretsdump, alongside Mimikatz for credential theft and Plink for SSH tunneling. Operators use compromised administrative accounts and RDP tunneled over SSH for lateral movement and manual ransomware deployment. Other observed techniques include scheduled-task persistence, network and storage reconnaissance, deployment of a Python keylogger, attempts to disable Microsoft Defender, deletion of RDP logs, and use of BCWipe to remove evidence and alter timestamps. Its ransom messaging imitated REvil's formatting and directed victims to communicate through Telegram.