Categories: Malware

Vault 7 Leaks: CIA Hacking Tool “Angelfire” Secret Document Revealed to Compromise Windows OS – WikiLeaks

WikiLeaks Revealed a new Document of CIA Hacking Tool called “Angelfire” which comprised of 5 integrated components that are used to Compromise the Windows Computers Especially Windows 7 and Windows XP.

Angelfire integrated componenets are Solartime, Wolfcreek, Keystone (previously MagicWand), BadMFS, and the Windows Transitory File system.

Few Day Before WikiLeaks Revealed Secret Cyber Operation Document called “ExpressLane” Against Their Intelligence Partners.

Angelfire is a Framework Designed by CIA that can load and execute custom implants (polymorphic multipartite virus) into the Targeting Windows Computer and infect partition boot sector.

5 Integrated components with  Angelfire Implant

Five comprised components are Performing Different Process with Angelfilre implant framework and it works on 32-bit and 64-bit versions of Windows XP and Windows 7, and on 64-bit versions of Windows Server 2008 R2.

These are the 5 Components  comprised with  Angelfire to infect the Windows Computer

Solartime

Solartime helps to modify the partition boot sector to load some kernel code. This Modification leads to modifies the Windows boot process so that when Windows loads boot time device.

A small file combined with implant driver and Solartime boot code is placed into a Small file on Disk and that Specific File is encrypted.

Wolfcreek

Above Solartime executes By helping of Wolfcreek kernel code. Wolfcreek can able to load other Drivers user-mode applications using its self-Loading Driver capability.

Keystone

According to CIA Document, Keystone is responsible for starting user applications. Any application started by MW is done without the implant ever being dropped to the file system. In other words, a process created and the implant is loaded directly into memory. Currently, all processes will be created as svchost.

BadMFS

BadMFS is a covert file system that helps to store all drivers and implants that Wolfcreek will start. It uses the encryption and obfuscation techniques to avoid string or PE header scanning.

Windows Transitory File system

Finally, a new method called  Windows Transitory File system helps to install Angelfire. CIA Document says the system allows an operator to create transitory files for specific actions including installation, adding files to Angelfire, removing files from Angelfire.

Previous CIA Leaked Tools

Vault 7 Leaks: CIA Conducts Secret Cyber Operation “ExpressLane” Against Their Intelligence Partners -WikiLeaks

Vault 7 Leaks: CIA Hacking Tool “CouchPotato” Remotely Capture Videos & Images -WikiLeaks

Vault 7 Leaks: CIA Cyber Weapon “Dumbo” Hack WebCams & Corrupt Video Recordings – WikiLeaks

 Vault 7 Leaks: CIA Hacking Tools “Achilles, Aeris, SeaPea” Revealed to Hack Mac and Linux OS -WikiLeaks

Raytheon – Vault 7 Leaks: CIA Owned PoC Malware Development Surveillance Projects “UCL Under Raytheon” Leaked – WikiLeaks

HighRise – Vault 7 Leaks: CIA Android Ha Vault 7 Leaks: CIA Hacking Tools “Achilles, Aeris, SeaPea” Revealed to Hack Mac and Linux OS -WikiLeaks

Hacking Tool “HighRise” Steals Data From Compromised Android Phones via SMS – WikiLeaks

Gyrfalcon –  Vault 7 Leaks: CIA Cyber Weapon “BothanSpy” and “Gyrfalcon” Steals SSH Credentials From Windows and Linux Computers – WikiLeaks

OutlawCountry – Vault 7 Leaks: CIA Malware “OutlawCountry” Controls Linux Machine and Redirect the Victims Traffic into CIA Controlled Machine – WikiLeaks

ELSA – Vault 7 Leaks: CIA Malware “ELSA” Tracking Geo-Location of WiFi Enabled Windows Computers – WikiLeaks

Brutal Kangaroo – CIA Hacking Tool “Brutal Kangaroo” Revealed to Hack Air-Gapped Networks by using USB Thumb Drives -WikiLeaks

CherryBlossom –  Wikileaks Revealed New CIA Wireless Hacking Tool “Cherry Blossom” Compromise Your Wireless Network Devices using MITM Attack

Pandemic –  New CIA Cyberweapon Malware “Pandemic” installed in Victims Machine and Replaced Target files where remote users use SMB to Download

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Threat Actors Manipulate Search Results to Lure Users to Malicious Websites

Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…

1 day ago

Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware

Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…

1 day ago

Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…

1 day ago

HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments

Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…

1 day ago

RansomHub Ransomware Group Hits 84 Organizations as New Threat Actors Emerge

The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…

1 day ago

Threat Actors Leverage Email Bombing to Evade Security Tools and Conceal Malicious Activity

Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…

2 days ago