Vault7 – Wikileaks published documentation for AfterMidnight and Assassin malware

WikiLeaks Reveals two distinct malware platforms codenamed AfterMidnight and Assassin used by the CIA operators to target Windows systems.

While critical infrastructure worldwide and private organizations were ridiculed by the WannaCry attack, WikiLeaks released a new batch of CIA documents from the Vault 7 leaks.

The new dump included the documentation related to two CIA frameworks used to create custom malware for Microsoft Windows platform.

The two frameworks are codenamed AfterMidnight and Assassin, both malware implements classic backdoor features that allowed the CIA to take control over the targeted systems.

Since March, WikiLeaks obtained thousands of files allegedly originating from a network of the U.S. Central Intelligence Agency (CIA). In a post I have published on the Infosec Institute I have summarized what has happened in the last weeks and what has been disclosed by the organization.

Below the list of previous batches published by Wikileaks:

• The Year Zero that revealed CIA hacking exploits for hardware and software.
• The Dark Matter dump is containing iPhone and Mac hacking exploits.
• The Marble batch focused on a framework used by the CIA to make hard the attribution of cyber attacks.
• The Grasshopper batch that reveals a framework to customize malware for breaking into Microsoft’s Windows and bypassing antivirus protection.
• The Scribbles Project for document tracking.
• The Archimedes tool to target computers inside a Local Area Network (LAN).

According to WikiLeaks, the AfterMidnight malware framework allows CIA operators to dynamically load and execute malicious payload on a target system.

The principal payload is disguised as a self-persisting Windows Dynamic-Link Library (DLL) file and executes small payloads dubbed “Gremlins” that are able to subvert the functionality of targeted software, gather target’s information, or providing services for other gremlins.

“‘Gremlin’ is the term for an AM payload that is meant to run hidden on target and either:

• Subvert the functionality of targeted software.
• Provided basic survey/exfil.
• Provide internal services for other gremlins” states the documentation.