WikiLeaks releases documents on two CIA projects targeting network protocols

The WikiLeaks whistleblowing platform released on Thursday a new package of CIA documents from the so-called Vault VII project, in particular the documents on two separate CIA projects aimed at stealing users’ login details for remote access to a server of a website.
“Today, July 6, WikiLeaks publishes documents from the BothanSpy and Gyrfalcon projects of the CIA.
The implants described in both projects are designed to intercept and exfiltrate SSH credentials but work on different operating systems with different attack vectors,” WikiLeaks said in a statement.
SSH is a cryptographic network protocol which gives the user a secure remote access to a website’s server.
The SSH credentials are the login details, namely the server address, port number, the username and the password.
According to WikiLeaks, the BothanSpy is an implant targeting the SSH client program for Microsoft Windows platform, stealing user credentials form active SSH sessions.
The data is then either exfiltrated to a CIA-controlled server, or encrypted and saved for later exfiltration by other means.
Gyrfalcon, in its turn, is an implant that targets Linux platforms and can steal the credentials, encrypting the information for later exfiltration.
WikiLeaks released three documents that appear to be the CIA’s tool documentation and user manuals for both projects as evidence.
The whistleblowing website released the first patch from the Vault VII project in March, with the first full part comprising 8,761 documents.
The previous release, dedicated to the CIA spying geo-location malware for WiFi-enabled devices, dubbed “ELSA”, took place on June 28.