WikiLeaks Releases New Docs on CIA Malware

WikiLeaks unveiled new documents Friday that it claims detail the CIA's Grasshopper Framework, which is the platform used to build malware for computers running Microsoft Windows operating systems.

Grasshopper allows the CIA to construct customized malware as well a method of defining rules to "perform a pre-installation survey of the target device, assuring that the payload will only [be] installed if the target has the right configuration."

The CIA allegedly used "persistence mechanisms… taken from malware known as Carberp, a suspected Russian organized crime rootkit…. [The] persistence method, and parts of the installer, were taken and modified to fit our needs."

This would confirm that the CIA reuses malware it finds online, if the documents are authentic. However, the user guide for the persistence mechanism "Stolen Goods" notes that "a vast majority of the original Carberp code that was used has been heavily modified. Very few pieces of the original code exist unmodified."

In the release, WikiLeaks notes that these documents "provide an insights [sic] into the process of building modern espionage tools and insights into how the CIA maintains persistence over infected Microsoft Windows computers, providing directions for those seeking to defend their systems to identify any existing compromise."

• WikiLeaks: CIA Disguises Its Own Hacking to Appear Russian, Chinese
• CNN: WikiLeaks Says Roger Stone Had No Backchannel to the Group