Pierluigi Paganini July 28, 2017

Achilles

Achilles is a hacking tool that allows CIA operators to package malicious codes with a legitimate Mac OS app into a disk image installer (.DMG) file. According to the documents, Achilles v1.0 was developed in 2011, the CIA experts only tested it on Mac OS X 10.6 (Apple Snow Leopard OS launched in 2009).

The tool is a shell script written in Bash that gives the operators “one or more desired operator specified executables” for a one-time execution.

In a classic attack scenario, the target individuals download an infected disk image on their computer, once they will open and install the software, the malware would run in the background.

Once the malware is executed, it will erase any trace of the Achilles from the downloaded application so that the file would “exactly resemble” the original legitimate software. This behavior makes hard the investigation of the malware from security experts and antivirus software.

SeaPea

The SeaPea hacking tool is a Mac OS X Rootkit that gives CIA operators stealth and tool launching capabilities by hiding important files, processes and socket connections from the users.

It was developed in 2011, according to the documents SeaPea works on computers running then-latest Mac OS X 10.6 (Snow Leopard) Operating System (32- or 64-bit Kernel Compatible) and Mac OS X 10.7 (Lion) Operating System.

CIA operators need a root access to infect the target Mac computer, the hacking tools can be removed reformatting the startup disk or upgrading the OS to the next version.

Aeris

The Aeris hacking tool is an automated implant written in C programming language that could be used to backdoor portable Linux-based Operating Systems, including Debian, CentOS, Red Hat, FreeBSD and Solaris.

Below the list of features implemented by Aeris:

• Configurable beacon interval and jitterStandalone and Collide-based HTTPS LP support
• Standalone and Collide-based HTTPS LP supportSMTP protocol support
• SMTP protocol supportTLS Encrypted communications with mutual authentication
• TLS Encrypted communications with mutual authentication
• Compatibility with the NOD Cryptographic Specification
• Structured command and control that is similar to that used by several Windows
  implant-
• Automated file exfiltration
• Simple and flexible deployment and installation

Aeris is a builder that CIA operators can use to generate custom implants, it does not have a separate installer and in order to be deployed operators just need to place an Aeris binary in the desired directory.

“Aeris does not have a separate installer. To deploy it, simply place an Aeris binary in the desired directory. Rename the binary in any way that you wish. Note that the configuration is patched in at build time; hence, no additional files (beyond possibly those related to persistence — see the next section) are needed.” states the user guide.

Below the list of release published by Wikileaks since March:

Pierluigi Paganini

(Security Affairs –  Wikileaks, Imperial)

[adrotate banner=”13″]