WikiLeaks Releases New Batch of CIA Documents on Hacking Tools

The WikiLeaks has released another batch of CIA classified documents from the so-called Vault 7 project.

https://sputniknews.com/world/201706021054229410-wikileaks-cia-documents/

The WikiLeaks whistleblowing website released yet another batch of CIA classified documents from the so-called Vault 7 project, which has become the 10th publication of the agency's files dedicated to the hacking tools reportedly used by the intelligence service.

"Today, June 1st 2017, WikiLeaks publishes documents from the "Pandemic" project of the CIA, a persistent implant for Microsoft Windows machines that share files (programs) with remote users in a local network," WikiLeaks said in a Thursday press release.

The Pandemic tool is used to replace files on a computer with their trojaned versions if the targeted computer downloads information within a local network from the infected one, the press release added.

WikiLeaks began releasing the documents of the Vault 7 on March 7, with the first full part comprising 8,761 documents. The previous release took place on May 19 and was dedicated to the "Athena" spyware.

ALSO SEE

https://threatpost.com/wikileaks-dumps-cia-patient-zero-windows-implant/126036/

https://arstechnica.com/security/2017/06/wikileaks-says-cias-pandemic-implant-turns-servers-into-malware-carriers/

WikiLeaks says CIA’s “Pandemic” turns servers into infectious Patient Zero
====================

https://wikileaks.org/vault7/releases/#Pandemic

Vault 7: Projects

On June 1, 2017, WikiLeaks published documents from the "Pandemic" project of the CIA, a persistent implant for Microsoft Windows machines that share files (programs) with remote users in a local network. "Pandemic" targets remote users by replacing application code on-the-fly with a trojaned version if the program is retrieved from the infected machine. To obfuscate its activity, the original file on the file server remains unchanged; it is only modified/replaced while in transit from the pandemic file server before being executed on the computer of the remote user. The implant allows the replacement of up to 20 programs with a maximum size of 800 MB for a selected list of remote users (targets).

As the name suggests, a single computer on a local network with shared drives that is infected with the "Pandemic" implant will act like a "Patient Zero" in the spread of a disease. It will infect remote computers if the user executes programs stored on the pandemic file server. Although not explicitly stated in the documents, it seems technically feasible that remote computers that provide file shares themselves become new pandemic file servers on the local network to reach new targets.

Leaked Documents
Pandemic 1.1 (S/NF)
Pandemic 1.1-RC1 (S/NF)
Pandemic 1.1-RC1 -- IVVRR Checklist
Pandemic 1.0 (S/NF)
Pandemic 1.0 -- IVVRR Checklist

https://sputniknews.com/world/201706021054229410-wikileaks-cia-documents/