n0mad1k
23 KiB
Cyber Implants & Tools Manual
Synthesized from: WikiLeaks Vault 7 (CIA Hacking Tools), Vault 8 (CIA Source Code), CIA Engineering Development Group documentation, classified tool user guides and design documents
Classification: Source material is SECRET//NOFORN (leaked). This synthesis is for educational/red team reference purposes.
Table of Contents
- Overview — CIA Cyber Arsenal
- Implants & Backdoors
- Persistence Frameworks
- Network Device Exploitation
- Air-Gap Operations
- Credential Theft
- Collection Tools
- Support & Evasion Tools
- False Flag Operations (Umbrage)
- Operational Patterns & Detection
Chapter 1: Overview — CIA Cyber Arsenal
1.1 The Engineering Development Group
The majority of Vault 7 tools were developed by the CIA's Engineering Development Group (EDG), a unit within the Directorate of Digital Innovation. EDG functions as the CIA's internal offensive tool development shop — the equivalent of NSA's TAO (Tailored Access Operations) but focused on human-deployed tools rather than network-based exploitation.
Tools are classified SECRET//NOFORN and follow a formal development lifecycle with requirements documents, user guides, test plans, Independent Verification & Validation Review (IVVRR) checklists, and Tool Delivery Reviews (TDR). This bureaucratic rigor means the tools are well-documented — and that documentation is now public.
1.2 Tool Design Philosophy
Analyzing the Vault 7 tools reveals consistent design patterns:
Platform coverage: Windows is the primary target (Athena, Angelfire, AfterMidnight, Pandemic, Dumbo, EzCheese, Brutal Kangaroo). Linux has dedicated tools (OutlawCountry, Aeris, Gyrfalcon). macOS has limited coverage (Achilles). Mobile platforms have specialized tools (HighRise for Android). Network devices are targeted with firmware implants (CherryBlossom).
Persistence over capability: Most tools prioritize survival — staying on the target system undetected — over offensive capability. The persistence mechanisms are sophisticated (boot sector modification, DLL hijacking, kernel modules, covert filesystems). The actual collection/exfiltration capabilities are often straightforward once persistence is achieved.
Modularity: Tools like AfterMidnight use a modular architecture where the persistence mechanism (the "platform") is separate from the capability modules ("Gremlins"). This allows operators to deploy the platform once and load/unload capabilities as needed without re-deploying the implant.
Minimal footprint: Tools are designed to minimize their forensic footprint. BadMFS creates a covert filesystem invisible to the OS. Marble obfuscates strings to defeat forensic analysis. Dumbo disables recording devices during physical access operations.
Chapter 2: Implants & Backdoors
2.1 Athena (Windows)
Classification: SECRET//NOFORN Developer: CIA EDG + Siege Technologies (contractor) Platforms: Windows 7, 8, 10 MITRE ATT&CK: T1574.001 (DLL Search Order Hijacking), T1543.003 (Windows Service)
What it is: A beacon-loader implant that runs in user space and communicates from within the srvhost process. At its core, Athena is deceptively simple — it hijacks a system DLL, loads into a legitimate service process, and beacons to a command-and-control server.
Two variants:
Athena-Alpha targets the RemoteAccess service. This service enumerates the registry to find an IP support DLL called iprtrmgr.dll. The implant replaces this DLL and forwards all original export functions to the legitimate module. When the service starts, the implant loads alongside it. By default, the RemoteAccess service is disabled — the installer enables it.
Athena-Bravo targets the Dnscache service. This service looks for a support DLL called dnsext.dll. This extension is available on Windows 7 and 8 (not legacy OS). By default, this service is active, making Bravo less conspicuous than Alpha (no need to enable a disabled service).
Persistence mechanism — DLL Forwarding: The target DLLs export a small number of functions. The implant DLL forwards those function calls to the original DLL at startup time. The service continues to function normally while the implant runs in the background. This is invisible to the user and to most security software because the service behaves exactly as expected.
Key technical detail: After installation, the srvhost process must be updated to allow the implanted service to run as SYSTEM. The installer modifies the srvhost list to include the service in a SYSTEM srvhost with correct privileges. Until a reboot, the tool has limited security access.
Detection indicators:
- Unexpected
iprtrmgr.dllordnsext.dllin system directories with non-Microsoft signatures - RemoteAccess service enabled on systems where it should be disabled
- Modified srvhost service grouping
- Beacon traffic from srvhost process to unknown external IPs
- DLL forwarding chains (imports that redirect to other DLLs)
2.2 Pandemic (Windows)
Classification: SECRET//NOFORN Developer: CIA EDG Version: 1.1 (January 2015) Platforms: Windows (SMB file servers) MITRE ATT&CK: T1080 (Taint Shared Content), T1221 (Template Injection)
What it is: A file system minifilter driver that replaces files on-the-fly as remote users access them via SMB. When a target system running Pandemic serves files to a remote client, the files are replaced with trojanized versions during transit. The original files on disk are never modified.
How it works: Pandemic installs as a Windows filesystem minifilter driver — the same type of driver used by antivirus software to intercept file operations. When a remote user requests a file via SMB, the minifilter intercepts the read operation and substitutes a different file. The original file remains untouched on disk. Only the remote user receives the modified version.
Operational significance: This is a lateral movement and distribution tool. A single Pandemic installation on a file server can distribute trojanized software to every user who accesses that server. The infection spreads as users execute the files they download.
Detection indicators:
- Unexpected minifilter driver registered in the filter manager stack
- Files served via SMB that differ from their on-disk copies (compare network capture vs disk forensics)
- Minifilter driver with no corresponding legitimate software installation
2.3 OutlawCountry (Linux)
Classification: SECRET//NOFORN Developer: CIA EDG Version: 1.0 (June 2015) Platforms: Linux (CentOS 6.x, 64-bit with kernel 2.6.32) MITRE ATT&CK: T1014 (Rootkit), T1599 (Network Boundary Bridging)
What it is: A Linux kernel module that provides covert netfilter-based internet traffic redirection. Once loaded, it creates hidden iptables rules that are invisible to user-space tools (iptables -L does not show them). This allows the operator to redirect network traffic through controlled infrastructure without the system administrator's knowledge.
How it works: OutlawCountry loads as a standard kernel module but creates a hidden netfilter table that is not visible through normal iptables interfaces. The operator can add rules to this hidden table to redirect outbound traffic (DNS, HTTP, HTTPS) to CIA-controlled servers for interception or modification.
Operational significance: This is a persistent network interception tool. On a Linux server that routes traffic for an organization, OutlawCountry can silently redirect all traffic through CIA infrastructure.
Detection indicators:
- Unexpected kernel modules loaded (
lsmod,/proc/modules) - Netfilter tables that don't match the visible iptables configuration
- Network traffic taking unexpected routes (traceroute anomalies)
- Kernel module files in unexpected locations
2.4 Aeris (POSIX)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Linux, Solaris, FreeBSD, and other POSIX-compliant systems MITRE ATT&CK: T1071.001 (Web Protocols), T1573.002 (Asymmetric Cryptography)
What it is: A POSIX-compatible implant written in C. Supports automated file exfiltration, configurable beacon intervals, and TLS-encrypted communications with the C2 server.
Operational significance: Aeris is the CIA's general-purpose implant for Unix-like systems. Where Athena targets Windows, Aeris provides equivalent capability across the POSIX ecosystem. Its portability across Linux, Solaris, and BSD makes it suitable for targeting servers, networking equipment running Unix-like OS, and embedded systems.
2.5 AfterMidnight (Windows)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Windows MITRE ATT&CK: T1574.001 (DLL Hijacking), T1129 (Shared Modules)
What it is: A modular Windows implant framework. The base implant masquerades as a Windows DLL, self-persists, and supports dynamically loaded payload modules called "Gremlins."
Architecture: AfterMidnight is a two-component system:
- The platform — A persistent DLL that loads at boot and provides a framework for loading, executing, and unloading Gremlins
- Gremlins — Payload modules that provide specific capabilities (keylogging, screen capture, file exfiltration, etc.)
Operational significance: The modular design means the platform is deployed once. Capabilities are added and removed as needed without re-deploying the implant. AlphaGremlin is the task scheduling component that manages when and how Gremlins execute.
Chapter 3: Persistence Frameworks
3.1 Angelfire / Wolfcreek (Windows)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Windows MITRE ATT&CK: T1542.003 (Bootkit), T1014 (Rootkit), T1564.005 (Hidden File System)
What it is: A five-component Windows persistence framework that modifies the boot process to load implants before the OS fully initializes.
The five components:
-
Solartime — Modifies the partition boot sector to load Wolfcreek during the Windows boot process. This executes before the OS kernel is fully loaded, giving the implant a privileged position.
-
Wolfcreek — A kernel-mode driver loaded by Solartime. Provides a platform for loading additional user-mode implants. Operates at the kernel level, making it invisible to user-space security tools.
-
Keystone — The user-mode component loaded by Wolfcreek. Provides the interface between the kernel-mode persistence mechanism and the operational payloads.
-
BadMFS — A covert file system. Creates a hidden storage partition that is invisible to the operating system. Used to store implant components, configuration data, and exfiltrated material where forensic tools cannot easily find them.
-
Windows Transitory File System — A component for loading file-based implants without leaving artifacts on the standard file system.
Operational significance: Angelfire represents the most sophisticated persistence mechanism in the Vault 7 collection. By modifying the boot sector and loading before the OS, it bypasses all OS-level security controls. The covert filesystem (BadMFS) ensures that even if the OS is forensically imaged, the implant storage is not visible through standard analysis.
Detection indicators:
- Modified partition boot sector (compare against known-good boot sector hashes)
- Unexpected kernel drivers loaded early in the boot sequence
- Disk sectors containing data that don't correspond to any visible filesystem
- Anomalous disk I/O to sectors not mapped to any partition
Chapter 4: Network Device Exploitation
4.1 CherryBlossom (Wireless Routers)
Classification: SECRET//NOFORN Developer: CIA + SRI International (contractor) Platforms: Wireless routers and access points (multiple vendors) MITRE ATT&CK: T1557 (Adversary-in-the-Middle), T1200 (Hardware Additions)
What it is: A framework for exploiting wireless networking devices (routers, access points). CherryBlossom replaces the router's firmware with an implanted version that provides persistent access to all network traffic flowing through the device.
Architecture:
- Flytrap — The implanted firmware installed on the target router. Replaces the stock firmware while maintaining normal router functionality. Beacons to the CherryTree server.
- CherryTree — The command-and-control server that manages Flytrap implants. Receives beacons, issues tasking, and collects intercepted data.
- CherryWeb — A browser-based interface for operators to manage implanted devices through the CherryTree server.
- Mission — The tasking system that defines what data to collect from the target network.
Test infrastructure (from leaked documents): The CherryBlossom test environment used IPs in the 10.6.6.0/24 and 10.6.7.0/24 ranges with VPN tunnels between components. Components included: Mobile VPN server, Flytrap (implanted router), CherryTree server, Beacon, Mission, Snoball, and ICON.
Operational significance: Compromising a router gives access to ALL traffic on that network without touching any endpoint. This is a network-level implant that is invisible to endpoint security tools. The target organization's computers, phones, and IoT devices are all monitored through their own infrastructure.
Chapter 5: Air-Gap Operations
5.1 Brutal Kangaroo / Drifting Deadline
Classification: SECRET//NOFORN Developer: CIA EDG Version: 1.2 (February 2016) Platforms: Windows, USB removable media MITRE ATT&CK: T1091 (Replication Through Removable Media), T1052.001 (Exfiltration Over USB)
What it is: A toolsuite for penetrating air-gapped networks using infected USB drives as the bridge. Drifting Deadline is the primary component that creates a covert data exfiltration channel across the air gap.
How it works: The attack chain:
- Infect a USB drive that will be used by someone with access to the air-gapped network
- When the USB is inserted into a computer on the air-gapped network, the implant executes
- The implant surveys the air-gapped network and collects target data
- Collected data is staged on the USB drive in a covert partition
- When the USB is returned to an internet-connected computer, the data is exfiltrated
Operational significance: Air-gapped networks are considered the gold standard of network security — physically disconnected from the internet. Brutal Kangaroo demonstrates that air gaps can be bridged through the human element: people who move USB drives between connected and disconnected networks.
5.2 EzCheese (Removable Media Exploitation)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Windows MITRE ATT&CK: T1091 (Replication Through Removable Media), T1203 (Exploitation for Client Execution)
What it is: An exploitation tool that triggers when Windows Explorer displays the folder contents of an infected removable drive. The exploit fires automatically when the user browses to the drive — no file execution required.
Operational significance: EzCheese lowers the bar for USB-based infection. The target doesn't need to run a file — merely opening the drive in Explorer is sufficient. This makes USB-based attacks more reliable and harder to defend against through user education ("don't run unknown executables" doesn't help when browsing a folder is enough).
Chapter 6: Credential Theft
6.1 BothanSpy (Windows SSH)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Windows (targets Xshell SSH client) MITRE ATT&CK: T1056.001 (Keylogging), T1555 (Credentials from Password Stores)
What it is: A credential harvesting tool that targets the Xshell SSH client on Windows. BothanSpy steals usernames, passwords, and SSH session content from active sessions.
Operational significance: SSH credentials provide access to remote servers, often in privileged contexts. A single compromised SSH session can provide access to entire server farms, especially if key-based authentication is used with shared keys.
6.2 Gyrfalcon (Linux SSH)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Linux (targets OpenSSH client) MITRE ATT&CK: T1056.001 (Keylogging), T1555 (Credentials from Password Stores)
What it is: The Linux counterpart to BothanSpy. Gyrfalcon captures usernames, passwords, and full session content from OpenSSH client sessions on Linux.
Together: BothanSpy (Windows) + Gyrfalcon (Linux) give the CIA coverage of SSH credential theft across both major desktop platforms.
Chapter 7: Collection Tools
7.1 ExpressLane (Biometric Collection)
Classification: SECRET//NOFORN Developer: CIA OTS (Office of Technical Service) Platforms: Windows (biometric collection systems) MITRE ATT&CK: T1005 (Data from Local System), T1036 (Masquerading)
What it is: A covert biometric data collection tool disguised as a software update for OEM liaison biometric systems. When the CIA provides biometric collection equipment to liaison services (foreign intelligence partners), ExpressLane is installed alongside it. During "software updates," ExpressLane exfiltrates the biometric data the liaison service has collected.
Operational significance: This reveals that the CIA backdoors equipment it provides to allied intelligence services. The "updates" are a pretext for data theft from partners. This has significant implications for international intelligence cooperation trust.
7.2 CouchPotato (Video Capture)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Windows MITRE ATT&CK: T1125 (Video Capture), T1557 (Adversary-in-the-Middle)
What it is: A remote tool for capturing RTSP/H.264 video streams from IP cameras and surveillance systems.
7.3 ELSA (WiFi Geolocation)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Windows MITRE ATT&CK: T1614 (System Location Discovery), T1016 (System Network Configuration Discovery)
What it is: A WiFi geolocation tool that collects nearby WiFi access point MAC addresses and signal strengths, then uses geo-lookup databases to determine the target device's physical location. No GPS required — WiFi access point mapping provides location data accurate to tens of meters in urban areas.
Chapter 8: Support & Evasion Tools
8.1 Dumbo (Device Disabling)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Windows MITRE ATT&CK: T1562.001 (Disable or Modify Tools)
What it is: A tool that identifies and disables webcams and microphones on a target system. Designed to support physical access operations — when CIA operatives need to enter a room without being recorded, Dumbo is deployed first to disable all recording devices.
Operational significance: Dumbo bridges cyber and physical operations. It is deployed before a physical entry to ensure the operative is not captured on webcam or recorded by microphone. This implies a workflow where cyber access precedes physical access.
8.2 HighRise (Android SMS Proxy)
Classification: SECRET//NOFORN Developer: CIA EDG Platforms: Android MITRE ATT&CK: T1437 (Application Layer Protocol), T1573 (Encrypted Channel)
What it is: An Android application that redirects SMS messages through an internet-based relay to a CIA listening post. Used for covert communications — a compromised Android device can serve as an SMS relay without the user's knowledge.
8.3 Protego (Missile Control)
Classification: SECRET//NOFORN Platforms: Embedded PIC microcontroller
What it is: PIC-based missile control system electronics with GPS targeting, in-flight guidance, and self-destruct capability. This is not a cyber tool — it is a weapons system. Its presence in the Vault 7 archive indicates CIA EDG's scope extends beyond cyber operations into weapons engineering.
Chapter 9: False Flag Operations (Umbrage)
9.1 The Umbrage Program
Organizational home: Remote Development Branch (RDB), CIA Purpose: Borrow techniques, code, and TTPs from other threat actors to create false attribution in CIA cyber operations.
Components:
- Hacking Team Source Dump Map — Analysis and cataloging of Hacking Team's source code (leaked in 2015) for reusable components
- PIQUE Assessments — Evaluations of tools and techniques from other actors for potential adoption
- Component Library — Reusable code modules borrowed from other actors' tools
Operational significance: Umbrage allows the CIA to conduct operations that, if discovered, would be attributed to other threat actors rather than the CIA. By using code patterns, techniques, and infrastructure associated with Russian, Chinese, or criminal groups, the CIA can create false flag cyber operations.
Implications for threat intelligence: If the CIA maintains a library of other actors' techniques specifically for false flag operations, then code-level attribution of cyber attacks is fundamentally unreliable. The presence of "Russian" or "Chinese" code in an attack does not prove the attack was conducted by Russia or China — it may prove only that the attacker had access to that code.
Chapter 10: Operational Patterns & Detection
10.1 Common CIA Patterns
Analyzing the Vault 7 tools reveals patterns that can inform both red team operations and defensive detection:
Persistence preferences:
- DLL hijacking (Athena, AfterMidnight) — low visibility, survives reboots
- Kernel modules (OutlawCountry, Wolfcreek) — highest privilege, hardest to detect
- Boot sector modification (Solartime/Angelfire) — pre-OS execution
- Service manipulation (Athena) — using legitimate Windows services as hosts
Communication patterns:
- Beacon-based C2 (periodic check-in rather than persistent connection)
- TLS encryption for C2 traffic
- Blending with legitimate traffic (HTTP/HTTPS beaconing)
- Use of legitimate process (srvhost) as network client
Deployment patterns:
- Physical access tools (Dumbo, ExpressLane) suggest human deployment alongside technical
- USB-based tools (Brutal Kangaroo, EzCheese) for air-gapped targets
- Router firmware replacement (CherryBlossom) for network-level access
10.2 Detection Framework
Endpoint indicators:
- Unexpected DLLs with export forwarding chains
- Modified boot sectors
- Kernel modules not associated with installed software
- Minifilter drivers with no corresponding application
- Services enabled that should be disabled (RemoteAccess)
- Modified srvhost service groupings
Network indicators:
- Periodic beacon traffic to unknown external IPs from system processes
- Router firmware hash mismatches against known-good images
- DNS/HTTP traffic taking unexpected routes
- TLS connections from processes that shouldn't be making network calls
Physical indicators:
- Webcam/microphone drivers disabled without user action
- USB devices with hidden partitions
- Biometric system behavior during "software updates"
This manual is a living document. As additional Vault 7 PDFs are parsed, deeper technical details
will be extracted and incorporated. Regenerate with python mosaic.py manual.