WikiLeaks revealed a CIA tool that translates the malware used by the secret service into the enemy's language.
WikiLeaks released the third batch of CIA documents on Friday, which focuses on anti-forensics tools that the agency possesses.
The previous two releases of Vault7 focused on CIA manuals and hacking tools. The first batch of leaked files was released on March 7, and lists exploits used to bypass security and encryption on Android devices, Apple iPhones, Samsung TVs, Windows or Mac computers, and other devices.
Two weeks later, with “episode two,” we learned that the CIA could install malware-spyware on Macs and iPhones before its targets bought them.
On Friday the new files that leaked present the source code of a secret anti-forensic tool that the CIA calls Marble Framework. The tool is designed to disguise the CIA's malicious software and make it almost undetectable by security researchers trying to analyze it. This is achieved by hiding (obfuscating) fragments of the code's text.
But the Marble Framework seems to have a feature that makes it stand out.
The tool provides everything to malware developers to masquerade that the malicious software was created by someone who does not speak English, but Chinese, Russian, Korean, Arabic and Persian. Naturally, as you have understood, these are the languages of the main cyber adversaries of the US, China, Russia, North Korea and (historically, at least) Iran.
WikiLeaks reports that this technology enables monitoring the lives of Americans by deceiving security researchers who, for example, think they are being monitored by the Chinese PLA team.1
The Marble Framework is used only for hiding information through the masquerading of malicious software, and it is not malware, which allowed WikiLeaks to release its source code.
Let us remind that WikiLeaks has pledged to make available the source code of all CIA hacking tools to the immediately interested companies.
