HackingTeam was a Milan-based information technology company that sold offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.^[1] Its "Remote Control Systems" enable governments and corporations to monitor the communications of internet users, decipher their encrypted files and emails, record Skype and other Voice over IP communications, and remotely activate microphones and camera on target computers.^[2] The company has been criticized for providing these capabilities to governments with poor human rights records,^[3] though HackingTeam states that they have the ability to disable their software if it is used unethically.^[4][5] The Italian government has restricted their licence to do business with countries outside Europe.^[6]

HackingTeam employs around 40 people in its Italian office, and has subsidiary branches in Annapolis, Washington, D.C., and Singapore.^[7] Its products are in use in dozens of countries across six continents.^[8]

HackingTeam was founded in 2003 by Italian entrepreneurs Vincenzetti and Valeriano Bedeschi. In 2007 the company was invested by two Italian VC: Fondo Next and Innogest.^[9]

The Milan police department learned of the company. Hoping to use its tool to spy on Italian citizens and listen to their Skype calls, the police contacted Vincenzetti and asked him to help.^[10] HackingTeam became "the first sellers of commercial hacking software to the police”.

According to former employee Byamukama Robinhood, the company began as security services provider, offering penetration testing, auditing and other defensive capabilities to clients.^[11] Byamukama states that as malware and other offensive capabilities were developed and accounted for a larger percentage of revenues, the organization pivoted in a more offensive direction and became increasingly compartmentalized. Byamukama claims fellow employees working on aspects of the same platform – for example, Android exploits and payloads – would not communicate with one another, possibly leading to tensions and strife within the organization.^[11]

In February 2014, a report from Citizen Lab identified the organisation to be using hosting services from Linode, Telecom Italia, Rackspace, NOC4Hosts and bullet proof hosting company Santrex.^[12]

On 5 July 2015 the company suffered a major data breach of customer data, software code, internal documents and e-mails. (See: § 2015 data breach)

On 2 April 2019 HackingTeam was acquired by InTheCyber Group to create Memento Labs ^[13]

Hacking Team enables clients to perform remote monitoring functions against citizens via their RCS (remote control systems), including their Da Vinci and Galileo platforms:^[1]

• Covert collection of emails, text message, phone call history and address books
• Keystroke logging
• Uncover search history data and take screenshots
• Record audio from phone calls

• Capture audio and video stream from device memory to bypass cryptography of Skype sessions^[14]
• Use microphones on device to collect ambient background noise and conversations

• Activate phone or computer cameras
• Hijack telephone GPS systems to monitor target's location
• Infect target computer's UEFI BIOS firmware with a rootkit^[15]
• Extract WiFi passwords^[16]
• Exfiltrate Bitcoin and other cryptocurrency wallet files to collect data on local accounts, contacts and transaction histories^[17]

HackingTeam uses advanced techniques to avoid draining cell phone batteries, which could potentially raise suspicions, and other methods to avoid detection.^[18][19]

The malware has payloads for Android,^[16] BlackBerry, Apple iOS, Linux, Mac OS X, Symbian, as well as Microsoft Windows, Windows Mobile and Windows Phone class of operating systems.^[20]

RCS is a management platform that allows operators to remotely deploy exploits and payloads against targeted systems, remotely manage devices once compromised, and exfiltrate data for remote analysis.

HackingTeam's clientele include not just governments, but also corporate clients such as Barclays and British Telecom (BT) of the United Kingdom, as well as Deutsche Bank of Germany.^[1]

A full list of HackingTeam's customers were leaked in the 2015 breach. Disclosed documents show HackingTeam had 70 current customers, mostly military, police, federal and provincial governments. The total company revenues disclosed exceeded 40 million Euros.^{[46][47][48][49][50][51]}

On Sep 8, 2021, SentinelLABS released a research report about a Turkish threat actor EGoManiac, that used Remote Control System (RCS), software from the Italian infosec firm Hacking Team, which was operated between 2010 and 2016 and campaign run by Turkish TV journalists at OdaTV for spying Turkish police.^[52]

• FinFisher
• MiniPanzer and MegaPanzer
• Vupen – 0-day exploit provider linked to HackingTeam^[69]
• Mamfakinch – a citizen media organization targeted with malware allegedly developed by HackingTeam^[70]