WikiLeaks Publishes Info on CIA's Tool to Secretly Load Implants on Computers

The WikiLeaks whistleblowing platform released Thursday new documents from the Vault 7 series, which contain information on the tool which the CIA used to load and execute implants targeting computers using Microsoft Windows operating systems.

The WikiLeaks whistleblowing platform released Thursday new documents on the CIA tool called Angelfire. It is an implant comprising of five components: Solartime, Wolfcreek, Keystone (previously MagicWand), BadMFS, and the Windows Transitory File system, according to Wikileaks.

The CIA reportedly uses Angelfire to load and execute malicious user applications on target computers. One of tool's components modifies the boot sector, allowing the implants to be downloaded simultaneously with Windows' boot time device drivers. Loaded implants never touch the file system, so it is rather difficult to track the process.

"Like previously published CIA projects (Grasshopper and AfterMidnight) in the Vault7 series, it is a persistent framework that can load and execute custom implants on target computers running the Microsoft Windows operating system (XP or Win7)," the statement from Wikileaks reads.

The revelation comes a week after Wikileaks released documents on the CIA's ExpressLane tool, which the agency uses to collect extra biometric data from US liaison services, such as the National Security Agency (NSA), the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI).

The publictaions are made as part of the Vault 7 project, a large archive of CIA-related classified documents that Wikieaks has obtained. The platform released the first batch of the documents in March, containing a total of 8,761 documents.

According to the website, a large archive comprising various viruses, malware, software vulnerability hacks and relevant documentation, was uncovered by US government hackers, which is how WikiLeaks gained access to some of the data from the trove.