Language Selection

English French German Italian Portuguese Spanish

CIA Uses "AfterMidnight" and "Assassin" Against Windows

Filed under
Microsoft

Today, May 12th 2017, WikiLeaks publishes "AfterMidnight" and "Assassin", two CIA malware frameworks for the Microsoft Windows platform.

"AfterMidnight" allows operators to dynamically load and execute malware payloads on a target machine. The main controller disguises as a self-persisting Windows Service DLL and provides secure execution of "Gremlins" via a HTTPS based Listening Post (LP) system called "Octopus". Once installed on a target machine AM will call back to a configured LP on a configurable schedule, checking to see if there is a new plan for it to execute. If there is, it downloads and stores all needed components before loading all new gremlins in memory. "Gremlins" are small AM payloads that are meant to run hidden on the target and either subvert the functionality of targeted software, survey the target (including data exfiltration) or provide internal services for other gremlins. The special payload "AlphaGremlin" even has a custom script language which allows operators to schedule custom tasks to be executed on the target machine.

"Assassin" is a similar kind of malware; it is an automated implant that provides a simple collection platform on remote computers running the Microsoft Windows operating system. Once the tool is installed on the target, the implant is run within a Windows service process. "Assassin" (just like "AfterMidnight") will then periodically beacon to its configured listening post(s) to request tasking and deliver results. Communication occurs over one or more transport protocols as configured before or during deployment. The "Assassin" C2 (Command and Control) and LP (Listening Post) subsystems are referred to collectively as" The Gibson" and allow operators to perform specific tasks on an infected target.

Read more

More in Tux Machines

today's howtos

KDE/Qt: Qt Contributor Summit 2018, Integrating Cloud Solutions with Qt, FreeBSD, and Konsole

  • Qt Contributor Summit 2018
    One bit especially interesting is the graphics stack. Back in Qt 5.0, Qt took the liberty of limiting the graphics stack to OpenGL, but the world has changed since: On Windows the only proper stack is Direct3D 12, Apple introduced Metal and recently deprecated OpenGL and Vulkan is coming rather strong. It looks like embracing these systems transparently will be one of the most exciting tasks to achieve. From a KDE & Plasma perspective I don’t think this is scary, OpenGL is here to stay on Linux. We will get a Framework based on a more flexible base and we can continue pushing Plasma, Wayland, Plasma Mobile with confidence that the world won’t be crumbling. And with a bit of luck, if we want some parts to use Vulkan, we’ll have it properly abstracted already.
  • Integrating Cloud Solutions with Qt
    These days, using the cloud for predictive maintenance, analytics or feature updates is a de facto standard in the automation space. Basically, any newly designed product has some server communication at its core. However, the majority of solutions in the field were designed and productized when communication technology was not at today’s level. Still, attempts are being made to attach connectivity to such solutions. The mission statement is to “cloudify” an existing solution, which uses some internal protocol or infrastructure.
  • KDE on FreeBSD – June 2018
    It’s been a while since I wrote about KDE on FreeBSD, what with Calamares and third-party software happening as well. We’re better at keeping the IRC topic up-to-date than a lot of other sources of information (e.g. the FreeBSD quarterly reports, or the f.k.o website, which I’ll just dash off and update after writing this).
  • Konsole’s search tool
    Following my konsole’s experiments from the past week I came here to show something that I’m working on with the VDG, This is the current Konsole’s Search Bar. [...] I started to fix all of those bugs and discovered that most of them happened because we had *one* search bar that was shared between every terminal view, and whenever a terminal was activated we would reposition, reparent, repaint, disconnect, reconnect the search bar. Easiest solution: Each Terminal has it’s own search bar. Setuped only once. The one bug I did not fix was the Opening / Closing one as the searchbar is inside of a layout and layouts would reposition things anyway. All of the above bugs got squashed by just moving it to TerminalDisplay, and the code got also much cleaner as there’s no need to manual intervention in many cases. On the review Kurt – the Konsole maintainer – asked me if I could try to make the Search prettier and as an overlay on top of the Terminal so it would not reposition things when being displayed.

LibreOffice 6.0 Is Now Ready for Mainstream Users and Enterprise Deployments

LibreOffice 6.0.5 is here one and a half months after the LibreOffice 6.0.4 point release to mark the open-source office suite as ready for mainstream users and enterprise deployments. The Document Foundation considers that LibreOffice 6.0 has been tested thoroughly and that it's now ready for use in production, enterprise environments. Until now, The Document Foundation only recommended the LibreOffice 6.0 office suite to bleeding-edge users while urging enterprises and mainstream users to use the well-tested LibreOffice LibreOffice 5.4 series, which reached end of life on June 11, 2018, with the last point release, LibreOffice 5.4.7. Read more

LibreOffice 6.0 Is Now Ready for Mainstream Users and Enterprise Deployments

The Document Foundation informed Softpedia today about the general availability of the fifth point release of the LibreOffice 6.0 open-source and cross-platform office suite for all supported operating systems. LibreOffice 6.0.5 is here one and a half months after the LibreOffice 6.0.4 point release to mark the open-source office suite as ready for mainstream users and enterprise deployments. The Document Foundation considers that LibreOffice 6.0 has been tested thoroughly and that it's now ready for use in production, enterprise environments. Read more Direct: The Document Foundation announces LibreOffice 6.0.5