Loading malware…
Memento is Windows ransomware used by the Memento Team operation and publicly identified in late 2021. Its payloads are Python 3.9 programs packaged with PyInstaller. An initial variant archived victim files and attempted direct encryption using AES-CBC, with RSA protecting per-file passwords. After endpoint protection blocked this approach, the operators revised the malware to place files into individual password-protected archives using a renamed legitimate WinRAR utility, encrypt the archive passwords, and delete the original files. This approach denied access to data while avoiding the direct file-encryption behavior detected by anti-ransomware protection.
The ransomware generates a victim identifier, collects system information, and transmits host details and execution telemetry to command-and-control infrastructure. Revised variants support command-line arguments and configurable processing exclusions.
Memento Team compromised an enterprise network through exploitation of CVE-2021-21972 in VMware vCenter Server and maintained access for several months before deploying ransomware in October 2021. The operators used credential-dumping tools, a separate Python keylogger, reconnaissance utilities, scheduled tasks, and RDP tunneled over SSH. They manually distributed the ransomware using stolen credentials and RDP, exfiltrated data before deployment, and threatened to publish stolen information alongside a ransom demand of approximately $1 million. The victim recovered most data from backups; captured archive passwords also enabled recovery of some affected files.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Memento is a Python-based ransomware used by the Memento group. The first Memento variant simply encrypts files in the compromised machine.
In addition, several interesting connections were found between the Phosphorus group and the Memento Ransomware that first emerged in late 2021.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Sophos has seen Memento operators switching from encrypting systems with a Python-based ransomware strain to moving files into password-protected WinRAR archives due to anti-ransomware protection active on compromised devices.
Memento, that failed to encrypt files so instead copied them into password-protected archives
Sophos has seen Memento operators switching from encrypting systems with a Python-based ransomware strain to moving files into password-protected WinRAR archives due to anti-ransomware protection active on compromised devices.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.