Short Bytes: Continuing the ongoing Vault 7 leaks, WikiLeaks has exposed more CIA-developed malware. Leaked malware includes Aeris, which is an automated implant for infecting Linux systems. The other two malware, named Achilles and SeaPea, affect Apple’s macOS operating system. These malware are a part of CIA’s Imperial project.
WikiLeaks has been exposing CIA-developed hacking tools on a regular basis since early 2017. These leaks are a part of Vault 7 leaks, which have witnessed tons of hacking tools that target different operating systems with different attack vectors. In this series, WikiLeaks has exposed CIA’s Imperial project.
The Imperial project contains information regarding this hacking tools. While Achilles and SeaPea target Apple’s macOS operating system, Aeris targets Linux-based systems.
Let’s tell you about these Linux and macOS hacking tools one by one:
Aeris 2.1
Aeris, named after Final Fantasy VII’s Aeris Gainsborough, is an implant designed to infect Linux-based systems. It’s an automated implant written in C that supports numerous POSIX-based systems. The supported platforms are:
- Debian Linux 7 (i386)
- Debian Linux 7 (amd64)
- Debian Linux 7 (ARM)
- Red Hat Enterprise Linux 6 (i386)
- Red Hat Enterprise Linux 6 (amd64)
- Solaris 11 (i386)
- Solaris 11 (SPARC)
- FreeBSD 8 (i386)
- FreeBSD 8 (amd64)
- CentOS 5.3 (i386)
- CentOS 5.7 (i386)
This highlight features of Aeris are configurable beacon interval, standalone HTTPS LS support, SMTP protocol support, TLS encrypted communications, automated file exfiltration, structured C&C, and compatibility with NOD cryptographic specification.
The distribution of Aeris Linux malware takes place with a set of Python utilities with one binary per platforms listed above.
Find detailed information: Aeris
Also Read: Best Hacking Tools Of 2017 For Windows, Linux, And OS X
Achilles 1.0
Achilles malware comes with the capability to inject trojans into a macOS installer, i.e., a DMG file, for a one-time execution.
Achilles has been tested in Intel processors running OS 10.6. The brief instruction manual of Achilles tells that the malicious DMG file should behave like the original DMG file. After the user runs the infected file, the payload will be installed and later removed. This way, the malware tried to erase its footprints and avoid suspicion.
Find Achilles user guide: Achilles
SeaPea 4.0
SeaPea is a macOS toolkit that comes with stealth and tool launching features. It’s also able to hide files, socket connections, and processes on the infected systems. CIA has tested the SeaPea malware on OS X 10.6 and 10.7 operating systems.
The SeaPea toolkit operates by assigning the processes to one of the 3 different categories: Normal, Elite, and Super-Elite. All the commands in SeaPea are run as an Elite process.
Source:https://fossbytes.com/macos-linux-hacking-tools-cia-vault-7-wikileaks/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
