Softpedia >News >Security
Softpedia Homepage   

WikiLeaks Vault 7: CIA's "Pandemic" Tool Replaces Files with Malware

The latest WikiLeaks release focuses on Pandemic, a tool that replaces legitimate files with malicious payload

Jun 2, 2017 12:18 GMT  ·  By
WikiLeaks dumps another CIA tool
   WikiLeaks dumps another CIA tool

WikiLeaks has released a new set of documents from its Vault 7 series, this time detailing a tool that the CIA allegedly uses to spread malware on a targeted organization's network. 

Appropriately called "Pandemic," the tool can install a file system filter driver on a network, replacing legitimate files with malicious payload when they are accessed remotely via the Server Message Block (SMB) protocol.

"Pandemic does NOT//NOT make any physical changes to the targeted file on disk. The targeted file on the system Pandemic is installed on remains unchanged. Users that are targeted by Pandemic, and use SMB to download the targeted file, will receive the 'replacement' file," reads the tool's description.

This makes this tool a rather interesting one to have since it is particularly difficult to identify infected systems. Since Pandemic replaces files while in transit, instead of modifying them on the device the malware is running on, the legitimate files remain unchanged.

Replacing on the go

Pandemic is a tool that was designed to work on both 32-bit and 64-bit Windows systems and initially gets installed on machines from which users download and execute files remotely. The files released by WikiLeaks indicate that up to 20 files can be replaced at a time, each with a maximum size of 800 Mb.

"As the name suggests, a single computer on a local network with shared drives that is infected with the 'Pandemic' implant will act like a 'Patient Zero' in the spread of a disease. It will infect remote computers if the user executes programs stored on the pandemic file server. Although not explicitly stated in the documents, it seems technically feasible that remote computers that provide file shares themselves become new pandemic file servers on the local network to reach new targets," WikiLeaks writes about the release.

There's information in the files even about how to check whether a system was infected with Pandemic. Security experts have also pointed out to this on Twitter.  

Wikileaks has been releasing Vault 7 documents since March 7, exposing more and more CIA hacking tools.