Supposed CIA hacking tools used in 40 cyber attacks

By Barry Eitel

SAN FRANCISCO

Malicious software supposedly used by the Central Intelligence Agency (CIA) was linked to 40 cyber attacks since 2011, cyber security firm Symantec announced in a report Monday.

The hacking tools were discussed in documents leaked to the public earlier this year by the website WikiLeaks. The CIA has not confirmed the authenticity of the leaked information.

Symantec researchers say they have found software detailed in the WikiLeaks documents in connection to 40 hacks in 16 countries, including the United States. Most of the targets were in Europe, the Middle East, Asia and Africa.

Although the WikiLeaks documents outlined several computer programs supposedly used by the CIA to attacks targets by, for example, circumventing a mobile app’s encryption, Symantec focused on a malware tool named Vault 7.

The tool was used by a group Symantec calls Longhorn, but Symantec would not go so far as to say Longhorn was directly linked to the CIA.

“The tools used by Longhorn closely follow development timelines and technical specifications laid out in documents disclosed by WikiLeaks,” the researchers wrote in their report.

“The Longhorn group shares some of the same cryptographic protocols specified in the Vault 7 documents, in addition to following leaked guidelines on tactics to avoid detection. Given the close similarities between the tools and techniques, there can be little doubt that Longhorn's activities and the Vault 7 documents are the work of the same group.”

Longhorn used Vault 7 to infiltrate governments and international organizations, among other targets.