2017/03/07 - WikiLeak's publication of Vault 7: CIA Hacking Tools Revealed begins its new series of leaks on the Central Intelligence Agency. Code-named Vault 7 by WikiLeaks, it is the largest ever publication of confidential documents on the agency. The first full part of the series, Year Zero, comprises 8,761 documents and files from an isolated, high-security network situated inside the CIA's Center for Cyber Intelligence in Langley, Virgina. It follows an introductory disclosure last month of CIA espionage orders for the 2012 French presidential election. Year Zero and the tools themselves are discussed more in-depth on the Vault 7 page.
|
Contents
- 1 Background
- 3 Organizational Structure
- 4 Hacking Tools
- 5 Operations
- 6 Government Response
- 7 Articles
Background
Vault 7 is a series of WikiLeaks releases on the CIA and the methods and means they use to hack, monitor, control and even disable systems ranging from smartphones, to TVs, to even dental implants. The Vault7 leaks themselves can be found on WikiLeaks.
So far the first release in the Vault 7 series has been titled "Year Zero" and includes a number of branches of the CIA's Center for Cyber Intelligence and their projects.
This page and its related pages are meant to comprehensively break down the enormous material of Vault 7 into something more meaningful to readers less familiar with this technical material.
Companies & Products Targeted
Due to the size of this publication and redactions required, we are still in the process of identifying targets of CIA hacking with a community research challenge.
- Identifying Hacking Targets of CIA
Organizational Structure
The Vault 7 leak is focused on the Center for Cyber Intelligence in the CIA's Directorate of Digital Innovation. The following are the relevant branches and departments of CCI (also highlighted in the org chart).
Organizational Chart of CIA
- Engineering Development Group (EDG)
- Applied Engineering Division (AED)
- Embedded Development Branch (EDB)
- Remote Development Branch (RDB)
- Operational Support Branch (OSB)
- Mobile Development Branch (MDB)
- Automated Implant Branch (AIB)
- SED
- Network Devices Branch (NDB)
- CCI Europe Engineering
- Applied Engineering Division (AED)
- Technical Advisory Council (TAC)
Hacking Tools
This is a list of the malware, CIA hacking projects, and other vulnerabilities documented in Vault 7. Many have their own pages with additional details.
| Name | Description | Products Effected |
|---|---|---|
| AngerManagement | a collection of Hamr plugins for Android remote exploitation framework | Android |
| AntHill | ||
| Assassin | ||
| BaldEagle | ||
| Basic Bit | ||
| Bee Sting | ||
| Bumble | ||
| CandyMountain | ||
| Cascade | ||
| Caterpillar | ||
| Cannoli v2.0 | ||
| ConnectifyMe Research | ||
| CRUCIBLE | ||
| Cytolysis | ||
| DerStarke | ||
| Felix | ||
| Fight Club | ||
| Fine Dining | ||
| Flash Bang | ||
| Frog Prince | ||
| Grasshopper | ||
| Galleon | ||
| GreenPacket | ||
| Gyrfalcon | ||
| HammerDrill | ||
| HarpyEagle | ||
| HercBeetle | ||
| HIVE | ||
| Hornet | ||
| HyenasHurdle | ||
| Improvise | ||
| MaddeningWhispers | ||
| Magical Mutt | ||
| MagicVikings | ||
| Melomy DriveIn | ||
| Perseus | ||
| Pterodactyl | A device for covertly copying floppy disks, disguised as a day planner. Built in July 2013. | 3.5" floppy disks |
| Rain Maker | ||
| Reforge | ||
| RickyBobby | ||
| sontaran | ||
| QuarkMatter | ||
| SnowyOwl | ||
| Sparrowhawk | Keylogger software for Unix terminals | Solaris and FreeBSD |
| ShoulderSurfer | ||
| Taxman | ||
| The Gibson | ||
| Tomahawk | ||
| UMBRAGE | ||
| Weeping Angel | ||
| YarnBall |
Operations
According to the document iOS Team Acronyms and Terms the prefix JQJ* = tag given to names of operations'. In document 17760464 it states The Bakery delivered Cinnamon for the Cisco881 on June 8. Testing Cinnamon for use on an 881 for JQJSECONDCUT. The 881 being a Cisco router, it would see SECONDCUT would be an operation name.
| Name | Technique | Targets | Dates |
|---|---|---|---|
| JQJADVERSE | |||
| JQJDISRUPT | |||
| JQJDRAGONSEED | |||
| JQJFIRESHOT | |||
| JQJHAIRPIECE | |||
| JQJIMPROVISE | toolset for configuration, post-processing, payload setup and execution vector selection for survey / exfiltration tools supporting all major operating system | ||
| JQJSECONDCUT | |||
| JQJSLASHER | |||
| JQJSTEPCHILD | Compromise a Cisco 881 Router with Cinamon | Unknown | 2014 |
| JQJTHRESHER |
Government Response
On March 21, 2017 the Reddit user ArizonaGreenTea, who claims to be a federal government employee, posted this image displayed here.
