Angelfire: Cia Malware Infects Organization Kicking Sector To Hack Windows Pcs

Influenza A virus subtype H5N1 squad of hackers at the CIA, the Central Intelligence Agency, allegedly used a Windows hacking tool against its targets to arrive at persistent remote access.

As business office of its Vault vii leaks, WikiLeaks today revealed details well-nigh a novel implant developed yesteryear the CIA, dubbed AngelFire, to target computers running Windows operating system.

AngelFire framework implants a persistent backdoor on the target Windows computers yesteryear modifying their sectionalization kicking sector.

AngelFire framework consists 5 next components:

1. Solartime — it modifies the sectionalization kicking sector to charge too execute the Wolfcreek (kernel code) every fourth dimension the scheme boots up.

2. Wolfcreek — a self-loading driver (kernel code that Solartime executes) that loads other drivers too user-mode applications

3. Keystone — a ingredient that utilizes DLL injection technique to execute the malicious user applications straight into scheme retention without dropping them into the file system.

4. BadMFS — a covert file scheme that attempts to install itself inwards non-partitioned infinite available on the targeted estimator too stores all drivers too implants that Wolfcreek starts.

5. Windows Transitory File system — a novel method of installing AngelFire, which allows the CIA operator to exercise transitory files for specific tasks similar adding too removing files to AngelFire, rather than laying independent components on disk.

According to a user manual leaked yesteryear WikiLeaks, AngelFire requires administrative privileges on a target estimator for successful installation.

The 32-bit version of implant works against Windows XP too Windows 7, piece the 64-bit implant tin target Server 2008 R2, Windows 7.

Previous Vault vii CIA Leaks

Last week, WikiLeaks published some other CIA project, dubbed ExpressLane, which detailed well-nigh the spying software that the CIA agents used to spy on their intelligence partners only about the world, including FBI, DHS too the NSA.

Since March, WikiLeaks has published 22 batches of "Vault 7" series, which includes the latest too terminal calendar week leaks, along alongside the next batches:

• CouchPotato — Influenza A virus subtype H5N1 CIA projection that revealed its might to spy on video streams remotely inwards real-time.
• Dumbo — Influenza A virus subtype H5N1 CIA projection that disclosed its might to hijack too manipulate webcams too microphones to corrupt or delete recordings.
• Imperial — Influenza A virus subtype H5N1 CIA projection that revealed details of three CIA-developed hacking tools too implants designed to target computers running Apple Mac OS X too unlike flavours of Linux OS.
• UCL/Raytheon — An alleged CIA contractor that analysed in-the-wild advanced malware too submitted at to the lowest degree 5 reports to the way for aid it develops its malware.
• Highrise — An alleged CIA projection that allowed the United States way to stealthy collect too frontwards stolen information from compromised smartphones to its server via SMS messages.
• BothanSpy too Gyrfalcon — Two alleged CIA implants that allowed the spy way to intercept too exfiltrate SSH credentials from targeted Windows too Linux computers using unlike ready on vectors.
• OutlawCountry — An alleged CIA projection that allowed the way to hack too remotely spy on computers running Linux operating systems.
• ELSA — Alleged CIA malware that tracks geo-location of targeted laptops too computers running the Microsoft Windows OS.
• Brutal Kangaroo — Influenza A virus subtype H5N1 tool suite for Microsoft Windows OS used yesteryear the CIA agents to target unopen networks or air-gap computers within an organisation or company without requiring whatever conduct access.
• Cherry Blossom — Influenza A virus subtype H5N1 framework employed yesteryear the way to monitor the Internet activity of the targeted systems yesteryear exploiting flaws inwards Wi-Fi devices.
• Pandemic — Influenza A virus subtype H5N1 CIA's projection that allowed the spying way to plow Windows file servers into covert ready on machines that tin silently infect other PCs of involvement within the same network.
• Athena — Influenza A virus subtype H5N1 spyware framework that the way designed to get got total command over the infected Windows systems remotely too works against every version of Windows OS–from Windows XP to Windows 10.
• AfterMidnight too Assassin — 2 alleged CIA malware frameworks for the Microsoft Windows platform that's meant to monitor too written report dorsum actions on the infected remote host PC too execute malicious actions.
• Archimedes — Man-in-the-middle (MitM) ready on tool allegedly developed yesteryear the way to target computers within a Local Area Network (LAN).
• Scribbles — Software allegedly designed to embed 'web beacons' into confidential documents, allowing the CIA agents to rails insiders too whistleblowers.
• Grasshopper — Influenza A virus subtype H5N1 framework which allowed the spying way to easily exercise custom malware for breaking into Microsoft's Windows OS too bypassing antivirus protection.
• Marble — Source code of a cloak-and-dagger anti-forensic framework used yesteryear the way to cover the actual source of its malware.
• Dark Matter — Hacking exploits the spying way designed to target iPhones too Macs.
• Weeping Angel — Spying tool used yesteryear the CIA agents to infiltrate smart TV's, transforming them into covert microphones.
• Year Zero — CIA hacking exploits for pop hardware too software.

Share This :