Loading story…
Sophos reported that the Memento Team gained initial access by exploiting an exposed VMware vCenter Server vulnerability, then remained in the victim environment for more than six months while stealing credentials, moving laterally over RDP, and exfiltrating data. During that dwell time, the same exposed server was also compromised by unrelated intruders who deployed XMR and XMRig cryptocurrency miners, underscoring the prolonged exposure of the environment.
After a failed attempt to encrypt files directly, Memento reworked its malware to evade encryption protections by placing victim files into password-protected WinRAR archives, encrypting the archive passwords, and deleting the originals before issuing a ransom demand of about $1 million in Bitcoin and threatening to leak stolen data. Sophos said the payloads were Python 3.9 programs packaged with PyInstaller, communicated with a command-and-control server at 78.138.105.150:11180, and used ransom-note styling similar to REvil while directing victims to Telegram; the victim restored most systems from backups, and investigators recovered some files because endpoint telemetry captured archive passwords during the attack.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
Sophos MTR's Rapid Response Team encountered the new ransomware group calling itself Memento Team in late October. The case revealed a long-running intrusion involving lateral movement, credential theft, and data exfiltration before ransomware deployment.
In October, the Memento gang installed Process Hacker on their primary foothold server and configured its kernel driver as a persistence service. This marked a further step in maintaining access on the victim network.
On September 28, the Memento attackers dropped another Plink binary via transfer.sh, disguised it as MicrosoftOutlookUpdater.exe, and used it to create a reverse shell to google.onedriver-srv.ml under the account name dontstarve. They also created a scheduled task named GoogleChangeManagementSchedule to exchange reconnaissance data with that host.
On September 8, an unrelated actor installed an XMRig miner and NSSM using PowerShell and files fetched from 190.144.115.54, lurchmath.org, and later GitHub. Sophos noted multiple actors had exploited the same exposed vCenter server.
On May 18, a different intruder exploited the same vCenter vulnerability to install an XMR cryptocurrency miner via PowerShell from 45.77.76.158:25643. The miner registered the WinRing0x64.sys driver as a service to use the server's graphics card for mining.
On May 10, the intruders used PowerShell to try to disable Microsoft Defender real-time monitoring. This was part of their effort to weaken defenses during the intrusion.
On May 4, attackers dropped PyInstaller-compiled Impacket tools including wmiexec and secretsdump onto a Windows server. Sophos said the tools were likely used to obtain credentials for later operations.
Sophos reported the victim's exposed VMware vCenter Server was likely exploited for initial access by the Memento intrusion, with evidence suggesting access may have begun as early as mid-April. The server was internet-exposed and lacked adequate endpoint detection and response.
The attackers demanded 15.95 BTC, roughly $1 million, for file recovery and threatened to expose stolen data if the victim did not pay. The ransom note borrowed REvil-style formatting and directed the victim to contact the attackers via Telegram.
After an initial direct-encryption attempt was blocked by endpoint protection, the attackers modified their malware to copy files into password-protected WinRAR archives, encrypt the archive passwords, and delete the originals. This unusual approach was used to bypass encryption protections.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that the **Memento Team** compromised a victim network through an exposed, unpatched **VMware vCenter Server** and remained inside the environment for more than six months. The attackers conducted hands-on-keyboard operations over **RDP**, used tools including **Impacket**, **Mimikatz**, **Plink**, **Process Hacker**, **BCWipe**, and a Python keylogger, and also exfiltrated data while threatening to leak it publicly as part of a **$1 million** extortion demand. After an initial attempt to encrypt files was partly blocked by endpoint protection, the group changed tactics and used **password-protected WinRAR archives** to bypass encryption defenses: they copied victim files into encrypted archives, encrypted the archive passwords, and deleted the originals. Sophos said the same exposed vCenter server was also exploited by other intruders to deploy **XMR** and **XMRig** cryptocurrency miners during the intrusion window, while the victim ultimately restored most systems from backups and investigators recovered some files because security logs had captured the archive passwords.
Aug 14, 2026
Researchers identified **CryptoHost**, also tracked as **Manamecrypt**, as a ransomware family that did not truly encrypt files but instead moved targeted data into a password-protected **RAR** archive and demanded **0.33 Bitcoin** for recovery. The malware reportedly stored both the archive and its executable under `AppData\Roaming`, established persistence through a **Run** registry key, and verified exact ransom payments through **blockchain.info** before releasing files. It was also reported as being bundled with a **uTorrent** installer and detected by security products as **`Ransom:MSIL/Manamecrypt.A`** and **`Ransom_CRYPTOHOST.A`**. Analysis of the malware showed the archive password was generated predictably from the archive name and the victim username, allowing affected files to be recovered without paying the ransom. Researchers also said the threat attempted to frustrate remediation by deleting the **SafeBoot** registry key and terminating processes associated with security tools, administration, gaming, shopping, and social-media applications. While some reports described the attacks as highly disruptive for users and companies, they also warned that ransom payment via **Bitcoin** remained risky and offered no guarantee of successful recovery, reinforcing the need for preventive security controls and backups.
Aug 15, 2026
Maze and Ragnar Locker were reported using increasingly sophisticated **double-extortion** tactics that combined data theft, public leak threats, and defense evasion during ransomware intrusions. Maze operators were linked to incidents including the attack on **Cognizant** and the publication of **2GB** of allegedly stolen files from the **City of Pensacola**, underscoring that victims faced both operational disruption and potential data-breach exposure. Reporting also tied Maze to intrusion activity using exposed **RDP**, signed **Cobalt Strike** payloads, **ngrok** tunneling, remote execution with `mshta`, and tailored persistence mechanisms, with one investigated intrusion stopped before encryption was launched. A key technical shift was the adoption of **virtual-machine-based encryption** to bypass endpoint defenses. In a Sophos-investigated case, Maze failed twice after security software blocked ransomware launched through scheduled tasks, then succeeded in deploying an **MSI** package that installed **VirtualBox** and a customized **Windows 7** VM, mounted host drives, and encrypted files from inside the guest system. That approach mirrored **Ragnar Locker**, which had already used a smaller **Windows XP** VirtualBox image to make encryption appear to come from a trusted process while continuing its broader playbook of RDP-driven access, lateral movement, shadow-copy deletion, service termination, and **Salsa20** plus **RSA-2048** encryption backed by leak-site extortion.
Aug 15, 2026