A new batch of secret files was leaked on April 14, shedding light on the CIA virus control system HIVE.
HIVE, a back-end infrastructure malware with a public-facing HTTPS interface, was used to transfer exfiltrated information from target machines to the CIA and to receive commands from its operators to execute specific tasks on the targets.
John Safa, security expert and founder of Pushfor, a secure messaging and content sharing platform for businesses, shared his views on the new WikiLeaks' release with Radio Sputnik.
"A very interesting release has come out. HIVE is a web-based interface that controls malware and spyware on different devices. So, for example, if you have spyware installed on a PC, it can be controlled by this technology. And what makes it more sophisticated is [that] it actually communicates over a VPN which is effectively an encrypted channel and also makes it like it's talking to different services that could be legitimate. So it is a very sophisticated technology," Safa told Radio Sputnik.
Commenting on the CIA technology busted by WikiLeaks, the security expert called attention to the fact that it is strikingly similar to the tools used by Longhorn, a North American cyberespionage group known to be active since 2011.
American cyber security provider Symantec started tracking Longhorn several years ago to learn more about the group's techniques and tools.
The most peculiar thing about the hacking group is that it looked nothing less than a state-sponsored entity.
"Prior to the Vault 7 leak, Symantec's assessment of Longhorn was that it was a well-resourced organization which was involved in intelligence gathering operations," Symantec's official press release says.
After examining WikiLeaks' documents the cyber security provider came to the conclusion that there is little doubt that Longhorn is part of the CIA hacking team.
Safa told Radio Sputnik that Longhorn conducted at least 40 attacks against targets in 16 countries across the globe. One attack, believed to be an unintentional one, was launched against a target in the US.
The security expert highlighted that the hacking group has focused primarily on international operating organizations, businesses and government entities. As Symantec remarked, "all of the organizations targeted would be of interest to a nation-state attacker."
The recent release by WikiLeaks has added to existing concerns about the extent of the CIA's hacking activity.
However, besides corporations and governmental organizations, ordinary users may also fall victim to cyberespionage.
The problem is that after the CIA hacking practices were made public by WikiLeaks, the exposed techniques could be easily used by any hackers around the world, the security expert warned.
Hackers may utilize the methods and source code detailed in WikiLeaks' documents to create their own malware to obtain personal information of general users, he believes.
As for the CIA, the new release may do do further damage to the organization, Safa remarked, assuming that the intelligence service will now have to "move quick" to cover up its future attacks and to remain undetected.
Have you heard the news? Sign up to our Telegram channel and we'll keep you up to speed!
