WikiLeaks has released a new batch of documents detailing a man-in-the-middle (MitM) attack tool dubbed Archimedes allegedly used by the CIA to target local networks.
The leaked documents, dated between 2011 and 2014, provide details about a tool initially codenamed Fulcrum and later renamed Archimedes by the development team.
The CIA hacking tool that allows the operators to redirect LAN traffic from a targeted computer through a machine controlled by the attackers before it is routed to the gateway.
“Archimedes is an update to Fulcrum 0.6.1.” reads the Archimedes Tool Documentation. “Archimedes is used to redirect LAN traffic from a target’s computer through an attacker-controlled computer before it is passed to the gateway. This enables the tool to inject a forged webserver response that will redirect the target’s web browser to an arbitrary location. This technique is typically used to redirect the target to an exploitation server while providing the appearance of a normal browsing session. For more tool information please refer to the original Fulcrum 0.6.1 documentation.”
According to the SANS instructor Jake Williams who analyzed the leaked documents, the Archimedes tool seems to be a repackaged version of the popular MitM tool Ettercap.
CIA alleged targets can use the leaked information about the Archimedes tool to check if their systems had been compromised by the US Intelligence.
Potential victims can search for these hashes for their systems.
Archimedes introduced several improvements with respect to the Fulcrum tool such as:
The tool itself is not sophisticated, it could be interesting to understand how CIA agents did use it in targeted attacks.
[adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Data Leak, AMP)
[adrotate banner=”5″]
[adrotate banner=”13″]
Cisco warns customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services…
Hot Topic suffered credential stuffing attacks that exposed customers' personal information and partial payment data.…
Cisco addressed multiple vulnerabilities in IOS and IOS XE software that can be exploited to…
Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…
Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…
The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…
This website uses cookies.