Monday, May 12, 2025
HomeMalwareNew CIA Cyberweapon Malware "Pandemic" installed in Victims Machine and Replaced Target...

New CIA Cyberweapon Malware “Pandemic” installed in Victims Machine and Replaced Target files where remote users use SMB to Download

Published on

SIEM as a Service

Follow Us on Google News

One of the  CIA Cyberweapon  Called  “Pandemic” Document Leaked by Vault 7 Projects of WikiLeaks.This Malware tool Specifically interact and run as kernel shellcode to install File system Driver.

This Malware will the attack the Victim Machine if user accesses the file via SMB, the Payload files will be Replaced to the  Actual Target file .This Function will work in Read-only Mode.

Already Released CIA cyberweapon’s DoublePulsar and MicroBotMassiveNet having some Sophisticated Futures and also affected by same SMB.

- Advertisement - Google News

“Pandemic” Malware’s Actual  Goal is to be installed in Victims Machine when the Victims remote users use SMB to download/execute PE files.

According the Leaked CIA’s “Pandemic” Secret Document,  It won’t make sense and it will not replace the Target file if the file is opened on the machine Where Pandemic is running on.

Pandemic Leads to Unchanged the File But Replaced

While “Pandemic” entered into the Victims Machine when user accesses the file via SMB,it will not do any physical Changes in the Target Files.

According to leaked Source of Vault 7 ,Users that are targeted by Pandemic, and use SMB to download the targeted file, will receive the ‘replacement’ file.

“Pandemic” can operate both 32 and 64 bit .CONOP(Concept of Operation) done by the CIA ,version 1.0 can works only on 64 bit targets.

A “Pandemic” Tool ability to Replace up to  20 files by using the Latest version of  Pandemic 1.0.

As per the Document “The 1.1 builder will dynamically re-size the output bin file to the  appropriate size needed to contain all the payload data, so there is no longer an absolute cap on total output bin size. There is, however, a hard-coded cap on the maximum size a single replacement file can be (800MB). Pandemic 1.1 also made some changes to improve the robustness of the swapping mechanism”

File Information of “Pandemic”

First version (1.0) of the “Pandemic” Developed on17 April, 2014 by Engineering Development Group of CIA and the versions has been updated on16 January 2015 with some extra capability including Replaced files up to 20 in victims machines.

Files Executable and DLL looks like Pandemic_Builder.exe, Control.dll

According to the  Leaked Sources File Registry access by “Pandemic” Performs like below

“S//NF) Pandemic registers a minifilter driver using Windows’ Flt* functions. As a result, FltMgr requires that all drivers registering as minifilters contain certain registry keys. Pandemic uses the ‘Null’ service key (on all Windows systems) as its own driver service key. Pandemic will create 2 sub keys and 3 values under the ‘Null’ service key in the registry. These values and sub keys are deleted when Pandemic is uninstalled at the end of its configured run timer, or when it is uninstalled via a special F&F (v2) DLL.These keys will NOT//NOT be deleted if the system is rebooted before the aforementioned scenarios occur”

you can Access full Leaked Document of CIA cyber weapon of Pandemic in WikiLeaks.

Also Read:

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...