Saturday, November 2, 2024
HomeHacksVault 7 Leaks : CIA Hacking Tools "Achilles, Aeris, SeaPea" Revealed to...

Vault 7 Leaks : CIA Hacking Tools “Achilles, Aeris, SeaPea” Revealed to Hack Mac and Linux OS -WikiLeaks

Published on

Malware protection

New  CIA Hacking Tools called “Achilles, Aeris, SeaPea” Revealed by WikiLeaks to Hack Mac and Linux Operating Systems Which is Developed  CIA Project named as imperial.

Achilles

A CIA Tool called Achilles V. 1.0 Developed to Create a trojanized OS X disk image (.dmg) installer.

Desire Execution files and Bash script inst are Allocated in Specific Tool_Directory and DMG installer installer-name.dmg obtain to Trojan.

- Advertisement - SIEM as a Service

Trojanized OS X Disk Image (dmg) behave as Original dmg and the first-time user needs to run all the application Executable then real Application launched later.

All the Traces files will be removed after the Execution of Trojan from .app and it will be replaced by original Trojan .app

It leads to developing a trojanized OS X Disk Image by an Operator.

Aeris

A second tool called Aeris 2. 1 is malware Developed for POSIX systems. which is Written in C language.

According to Document, it has an Ability to support automated file Exfiltration, configurable beacon interval and jitter, standalone and Collide-based HTTPS LP support and SMTP protocol support.

It has structured command & Control that is similar that used by several Windows malware.

These tools utilities seem it used to steal information from targeted hosts via secure TLS-encrypted channels.

This Malware Targeting following Linux Platform.

Debian Linux 7 (i386)
Debian Linux 7 (amd64)
Debian Linux 7 (ARM)
Red Hat Enterprise Linux 6 (i386)
Red Hat Enterprise Linux 6 (amd64)
Solaris 11 (i386)
Solaris 11 (SPARC)
FreeBSD 8 (i386)
FreeBSD 8 (amd64)
CentOS 5.3 (i386)
CentOS 5.7 (i386)

SeaPea

The third tool called SeaPea is an OS X Rootkit that provides a stealth and tool launching capabilities.

It was Developed in Shell Script and it was calling as Buildinstaller.py.

it has an ability to interact with the kernel of OS X  by CIA operators which lead to infect with OS X systems while rebooting.

SeaPea can able to hide files, Start socket connections and launch the malicious Files.

According to CIA’s SeaPea, Document Rootkit Operate in 3 categories.

  • Normal: A normal process is the default category for any process. The activity of a normal process is not hidden by the rootkit.
  • Elite: An elite process is hidden from normal processes and elite processes. That means that an elite process cannot see its own activity.
  • Super-Elite: A super-elite process is a type of elite process. A super-elite process is hidden from normal processes and elite processes, but not super-elite processes. This means that a super-elite process can see all activity. Only an elite process can become super-elite.

Previous CIA Leaked Tools by WikiLeaks

Raytheon – Vault 7 Leaks : CIA Owned PoC Malware Development Surveillance Projects “UCL Under Raytheon” Leaked – WikiLeaks

HighRise – Vault 7 Leaks : CIA Android Hacking Tool “HighRise” Steals Data From Compromised Android Phones via SMS – WikiLeaks

Gyrfalcon –  Vault 7 Leaks: CIA Hacking Tools “BothanSpy” and “Gyrfalcon” Steals SSH Credentials From Windows and Linux Computers – WikiLeaks

OutlawCountry – Vault 7 Leaks: CIA Malware “OutlawCountry” Controls Linux Machine and Redirect the Victims Traffic into CIA Controlled Machine – WikiLeaks

ELSA – Vault 7 Leaks: CIA Malware “ELSA” Tracking Geo-Location of WiFi Enabled Windows Computers – WikiLeaks

Brutal Kangaroo – CIA Hacking Tool “Brutal Kangaroo” Revealed to Hack Air-Gapped Networks by using USB Thumb Drives -WikiLeaks

CherryBlossom –  Wikileaks Revealed New CIA Wireless Hacking Tool “Cherry Blossom” Compromise Your Wireless Network Devices using MITM Attack

Pandemic –  New CIA Cyberweapon Malware “Pandemic” installed in Victims Machine and Replaced Target files where remote users use SMB to Download

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Telegram Bot Selling Phishing Tools to Bypass 2FA & Hack Microsoft 365 Accounts

A newly discovered phishing marketplace, ONNX Store, empowers cybercriminals to launch sophisticated attacks against...

Mobile Device Management Vendor Mobile Guardian Hacked

 Mobile Guardian, a leading Mobile Device Management (MDM) vendor, experienced unauthorized access to its...

Hunt3r Kill3rs Group claims they Infiltrated Schneider Electric Systems in Germany

The notorious cybercriminal group Hunt3r Kill3rs has claimed responsibility for infiltrating Schneider Electric's systems...