Kaspersky Labs revealed that a wave of malware infections detected in March 2025 can be traced back to 2022 and is tied to Memento Labs, the company that acquired and rebranded Italy’s infamous surveillance firm Hacking Team in 2019. The campaign, dubbed Operation ForumTroll, employed a sophisticated suite of spyware to infiltrate a broad spectrum of targets, including government bodies, media outlets, financial institutions, universities, and research centers across Russia. The threat actors behind the campaign used a combination of zero‑day exploits and social engineering to maintain persistence within compromised networks. Kaspersky’s analysis categorizes Operation ForumTroll as an advanced persistent threat, a designation typically reserved for state‑backed adversaries. The discovery underscores the ongoing evolution of commercial spyware vendors and their ability to pivot and rebrand after legal and regulatory pressures. While Hacking Team was dismantled after a massive data leak in 2019, its successor, Memento Labs, appears to continue the same line of malicious activity under a different corporate identity. The findings emphasize the need for robust endpoint protection, continuous threat monitoring, and a layered security approach to defend against sophisticated espionage campaigns.