Welcome to Watcher Forum
HomeCalendarFAQSearchMemberlistRegisterLog in

Share | 

 #Vault7: ‘CIA malware plants Gremlins’ on Microsoft machines – WikiLeaks

Go down 
Super Elite

Posts : 12324
Reputation : 394
Join date : 2012-01-06

PostSubject: #Vault7: ‘CIA malware plants Gremlins’ on Microsoft machines – WikiLeaks   Sun May 14, 2017 6:54 pm


#Vault7: ‘CIA malware plants Gremlins’ on Microsoft machines – WikiLeaks

May 12, 2017
WikiLeaks has released the latest instalment in the #Vault7 series, detailing two apparent CIA malware frameworks dubbed ‘AfterMidnight’ and ‘Assassin’ which it says target the Microsoft Windows platform.
The latest release consists of five documents detailing the two frameworks. ‘AfterMidnight’ allows operators to load and execute malware on a target machine, according to a statement from WikiLeaks.
The malware, disguised as a self-persisting dynamic-link library (DLL), unique to Microsoft, executes ‘Gremlins’ – small payloads which run hidden on the machine subverting the functionality of software as well as surveying the target and exfiltration of data. A payload named ‘AlphaGremlin’ allows operators to schedule customs tasks to be executed on the machine.


Once installed ‘AfterMidnight’ uses a HTTPS listening port to check for any scheduled events. Local storage related to ‘AfterMidnight’ is encrypted with a key not stored on the target machine, according to a user guide provided in the leak.
According to the leak, ‘Assassin’ is a similar type of malware to ‘AfterMidnight’. The tool’s user guide describes it as “an automated implant that provides a simple collection platform on remote computers running the Microsoft Windows operating system.”
The tool purportedly allows operators to perform specific tasks on an infected computer, periodically sending intercepted information to listening posts. It is made up of four subsystems: ‘Implant’, ‘Builder’, ‘Command and Control’, and ‘Listening Post’.
The ‘Implant’ provides the core logic and functionality of the tool on a target computer. The way it’s set up determines much of how the tool will behave on the target computer.
The ‘Builder’ arranges the Implant and ‘Deployment Executables’ before deployment, while the ‘Command and Control’ subsystem acts as an interface between the operator and the ‘Listening Post.’
The ‘Listening Post’ allows the ‘Implant’ to communicate with the subsystem through a web server.
Details of the document’s author are revealed in instructional screenshots of their desktop which appear in the ‘AlphaGremlin’ user guide. The screenshots also show a shortcut to Pidgin, an encrypted chat program, along with a folder named ‘Drone.’

Colm McGlinchey @ColmMcGlinchey
Screehgrab from latest #Vault7 release shows author is named 'Justin' and is using a #Dell machine #WikiLeaks
3:05 AM - 12 May 2017

  • 5 5 Retweets
  • 5

This article was posted: Friday, May 12, 2017 at 6:27 am
Back to top Go down
View user profile
#Vault7: ‘CIA malware plants Gremlins’ on Microsoft machines – WikiLeaks
Back to top 
Page 1 of 1
 Similar topics
» Color of Alien Plants
» interpretation of dream.....potted plants
» UK Companies to Build Water Purification Plants in Iraq
» Microsoft appoints first official Iraq distributor
» Assembly Plants and Manufacturer

Permissions in this forum:You cannot reply to topics in this forum
Watcher Forum :: Welcome! :: General Discussion-
Jump to: