WikiLeaks has released a trove of data belong to the American intelligence agency CIA (Central Intelligence Agency) – The latest batch shows how the CIA uses five different malware to target unsuspecting users.
These malware are called HammerLoss, Regin, HTTPBrowser, NfLog, and Gamker – The documents also show how the CIA used Raytheon Blackbird Technologies, a contractor for the Remote Development Branch (RDB) of the CIA.
The nightmarish revelations from Julian Assange are from over, and the latest batch of documents after the release of Vault 7 has startling new information about the CIA’s ability to hacking and infiltrating its targets. The data includes reports from experts about the way various malware programs owned and used by the CIA are used and the way these programs function. In total, there are five files.
This new batch of files is dubbed as UCL/Raytheon and contains documents maintained by Raytheon Blackbird Technologies. The firm is a contractor for the Remote Development Branch (RDB) of the CIA and believed to be its Technology Scout.
As per WikiLeaks, Raytheon was given the responsibility of “analyzing malware attacks in the wild and giving recommendations to the CIA development teams for further investigation and PoC development for their malware projects.”
The UCL/Raytheon leaks provide information about the CIA’s use of different malware programs between 2014 and 2015. The files have information about tools produced by the Hacking Team and how the HammerLoss malware from Russia was distributed using Twitter.
The first file explains how Emissary Panda, a China-based group, created at the HTTPBrowser remote access tool (RAT). The other file explains how Samurai Panda developed and used the Hacking Team inspired, NfLog based IsSpace RAT.
There is also information about the data collection malware Regin, also called Stealthy Surveillance and Gamker Trojan as well as HammerLoss. The purpose of HammerLoss is to “leverage Twitter and GitHub accounts” and compromise websites as well as Cloud storage for arranging command and control center for conducting a successful hack attack.
According to the WikiLeaks press release: “They mostly contain Proof-of-Concept ideas and assessments for malware attack vectors – partly based on public documents from security researchers and private enterprises in the computer security field.”
RELEASE: CIA-Rayethon analysis of #FireEye report on Twitter powered suspected Russian state malware #HammerToss https://t.co/RNJnNGo4c0 pic.twitter.com/wPN2XFl0h8
— WikiLeaks (@wikileaks) July 19, 2017
Vault 7 documents previously leaked documents by WikiLeaks
BothanSpy and Gyrfalcon: Steals SSH credentials from Linux & Windows devices
OutlawCountry and Elsa: Malware targeting Linux devices and tracking user geo-location
Brutal Kangaroo: CIA hacking tools for hacking air-gapped PCs
Cherry Blossom: CherryBlossom & CherryBomb: Infecting WiFi routers for years
Pandemic: A malware hacking Windows devices
AfterMidnight and Assassin: CIA remote control & subversion malware hacking Windows
Dark Matter: CIA hacking tool infiltrating iPhones and MacBooks
Athena: A malware targeting Windows operating system
Archimedes: A program helping the CIA to hack computers inside a Local Area Network
HIVE: CIA implants to transfer exfiltrated information from target machines
Grasshopper: A malware payloads for Microsoft Windows operating systems
Marble: A framework used to hamper antivirus companies from attributing malware
Dark Matter: A CIA project that infects Apple Mac firmware
Highrise Android Malware: An app called TideCheck employed by the CIA to target Android devices
Did you enjoy reading this article? Do like our page on Facebook and follow us on Twitter.
