The new release of the Wikileaks Vault 7 Series consists of 27 Documents of the Grasshopper Framework. The platform allows the CIA to build customized malware payloads for Microsoft Windows operating systems.
Modules provided in the “Grasshopper - Framework” can be used by a CIA operator as blocks to construct a customized implant that will behave differently based on the targets individual machine, e.g. maintaining persistence on the computer differently, depending on what particular features or capabilities are selected in the process of building the bundle. Additionally, Grasshopper provides a very flexible language to define rules that are used to
"perform a pre-installation survey of the target device, assuring that the payload will only be installed if the target has the right configuration"
providing the ability to build from very simple to very complex logic to determine, if the target device is running a specific version of Microsoft Windows, or if a particular Antivirus product is running or not in order to adapt the payload to the individual configurations of the Windows-OS.
Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). The requirement list of the Automated Implant Branch (AIB) for Grasshopper puts special attention on PSP avoidance, so that any Personal Security Products like 'MS Security Essentials', 'Rising', 'Symantec Endpoint' or 'Kaspersky IS' on target machines do not detect Grasshopper elements. Therefore can be executed without getting detected by Anti-Virus Software on the system.
One of the persistence mechanisms used by the CIA here is 'Stolen Goods' - whose "components were taken from malware known as Carberp, a suspected Russian organized crime rootkit." confirming the recycling of malware found on the Internet by the CIA. "The source of Carberp was published online, and has allowed AED/RDB to easily steal components as needed from the malware.". While the CIA claims that "[most] of Carberp was not used in Stolen Goods" they do acknowledge that "[the] persistence method, and parts of the installer, were taken and modified to fit our needs", providing a further example of reuse of portions of publicly available malware by the CIA, as observed in their analysis of leaked material from the italian company "HackingTeam".
The documents WikiLeaks publishes today provide an insights into the process of building modern espionage tools and insights into how the CIA maintains persistence over infected Microsoft Windows computers, providing directions for those seeking to defend their systems to identify any existing compromise
This picture shows that the malware re-installs itself after 22 hours by corrupting Windows-Updates even if they are disabled being executed when the WUPS stub is loaded since Windows-Update continues the same behaviour even it is disabled by the user.
Another interesting part is that the component of the malware known as “Carberp” from the “Stolen Goods Tool” is indeed stolen by the a suspected Russian rootkit used by organized crime or in other words the Russian Mafia.