Wikileaks Vault7: CIA Umbrage team, the factory of false flag ops

With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the “fingerprints” of the groups that the attack techniques were stolen from.” states Wikileaks.

 “UMBRAGE components cover keyloggers, password collection, webcam capture, data destruction, persistence, privilege escalation, stealth, anti-virus (PSP) avoidance and survey techniques.”

The team maintains a library of techniques borrowed from in-the-wild malware. The team has multiple purposes, the knowledge of attack patterns, of course, could help the agencies in forensics investigations to rapidly attribute the action of attackers to a specific actor.

But there is also another explanation, the library could be easily included in the CIA’s projects to achieve the following goals:

To reduce the cost and time to develop hacking tools to use in the cyber operations.

To make harder the attribution of cyber attacks and causing others threat actors to be blamed for the agency’s false flag operations.

The documents confirm that the technique borrowed by Umbrage team was the wiping component used by the dreaded Shamoon malware, the malicious code that destroyed more than 30,000 computers at Saudi Aramco in 2012.

Since December, security experts observed a spike in the number of attacks linked to a new variant the malware, so-called Shamoon 2.

The first Shamoon variant abused a commercial digitally-signed driver called RawDisk developed by a company named Eldos.

The experts at the Umbrage team used the same technique implemented by the Shamoon malware. They devised a method to bypass the license check for the RawDisk driver and implemented the same disk wiping technique in an internal hacking tool dubbed Rebound.

Then when malware researchers were discovering a Rebound sample in some systems they identified it as a Shamoon variant instead of the CIA implant.

The UMBRAGE team has many other techniques and tools in its arsenal. The experts were able for example to reproduce a persistence technique borrowed from the HiKit rootkit.

The CIA hackers are able to implement the webcam capture feature used by the infamous DarkComet RAT and also sandbox evasion techniques borrowed from the Trojan Upclicker and the Nuclear Exploit Pack.