Wikileaks reveals Brutal Kangaroo for infecting air-gapped PCs with malware

Latest Vault 7 leak details Brutal Kangaroo attack

Wikileaks dumped more CIA documents from its Vault 7 trove, this time detailing a tool used to infect air-gapped PCs with malware.

According to the latest leak, Brutal Kangaroo is a tool suite for Microsoft Windows that targets closed networks by air gap jumping using thumb drives.

"Brutal Kangaroo components create a custom covert network within the target closed network and providing functionality for executing surveys, directory listings, and arbitrary executables," the organisation said.

According to Wikileaks, Brutal Kangaroo consists of: Drifting Deadline, which is a thumb drive infection tool; Shattered Assurance, which is a server tool that handles automated infection of thumb drives; and Broken Promise, which is Brutal Kangaroo's postprocessor to evaluate collected information. It also features a tool called Shadow, which is the primary persistence mechanism (a stage two tool that is distributed across a closed network and acts as a covert command-and-control network. 

"When a user is using the primary host and inserts a USB stick into it, the thumb drive itself is infected with a separate malware. If this thumb drive is used to copy data between the closed network and the LAN/WAN, the user will sooner or later plug the USB disk into a computer on the closed network," said Wikileaks.

"By browsing the USB drive with Windows Explorer on such a protected computer, it also gets infected with exfiltration/survey malware. If multiple computers on the closed network are under CIA control, they form a covert network to coordinate tasks and data exchange," claimed Wikileaks, adding that the method of compromising closed networks is similar to how the Stuxnet worm worked.

It said that the primary execution vector used by infected thumb drives is a vulnerability in the Microsoft Windows operating system that can be exploited by hand-crafted link files that load and execute programs (DLLs) without user interaction. 

"Older versions of the tool suite used a mechanism called EZCheese that was a zero-day exploit until March 2015; newer versions seem to use a similar, but yet unknown link file vulnerability (Lachesis/RiverJack) related to the library-ms functionality of the operating system," said Wikileaks. 

Luckily, several antivirus products are capable of detecting the malware. These include Avira, Bitdefender, and Symantec.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020
Ransomwiz lets you test your security with simulated ransomware
ransomware

Ransomwiz lets you test your security with simulated ransomware

21 Sep 2020
Best free malware removal tools 2020
Security

Best free malware removal tools 2020

21 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Windows Server flaw sparks emergency US gov warning
vulnerability

Windows Server flaw sparks emergency US gov warning

21 Sep 2020