Memento ransomware used WinRAR archives to bypass file encryption defenses

Sophos reported that the Memento Team gained initial access by exploiting an exposed VMware vCenter Server vulnerability, then remained in the victim environment for more than six months while stealing credentials, moving laterally over RDP, and exfiltrating data. During that dwell time, the same exposed server was also compromised by unrelated intruders who deployed XMR and XMRig cryptocurrency miners, underscoring the prolonged exposure of the environment.

After a failed attempt to encrypt files directly, Memento reworked its malware to evade encryption protections by placing victim files into password-protected WinRAR archives, encrypting the archive passwords, and deleting the originals before issuing a ransom demand of about $1 million in Bitcoin and threatening to leak stolen data. Sophos said the payloads were Python 3.9 programs packaged with PyInstaller, communicated with a command-and-control server at 78.138.105.150:11180, and used ransom-note styling similar to REvil while directing victims to Telegram; the victim restored most systems from backups, and investigators recovered some files because endpoint telemetry captured archive passwords during the attack.