维基解密披露CIA Grasshopper远程木马套件 Windows预安装环境、Carberp财务恶意软件的计算机驻留方法都用上了...-CSDN博客

2017年4月7日，WikiLeaks 披露了第七批文档 "Grasshopper" ，CIA's Grasshopper framework其中包含了 27个文档 ,这是一个平台，用于构建自动以的恶意软件，主要针对微软Windows 操作系统。

维基解密第七批披露文档原文如下

Grasshopper提供了各种各样的模块, CIA使用这些模块构建自定义的木马，它的行为会有所不同，但会在不同的计算机上保持它的持久可用性，这取决于捆绑过程中选择的特定特征和功能。此外，Grasshopper提供了一种非常灵活的语言，这种语言可以制定规则，用于在目标设备上执行一个预安装的评估，这样做是为了确保目标具有正确的配置, 才会安装有效负载。这样, CIA可以构建或简单或复杂的逻辑,比如判断目标设备运行的是特定版本的 microsoft windows, 或者判断某个特定的防病毒产品正在运行。

小编：这里描述的就是Windows预安装环境，Windows预安装是什么？请参看

https://www.microsoft.com/china/licensing/sa/benefits/winpe.mspx

Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). The requirement list of the Automated Implant Branch (AIB) for Grasshopper puts special attention on PSP avoidance, so that any Personal Security Products like 'MS Security Essentials', 'Rising', 'Symantec Endpoint' or 'Kaspersky IS' on target machines do not detect Grasshopper elements.

One of the persistence mechanisms used by the CIA here is 'Stolen Goods' - whose "components were taken from malware known as Carberp, a suspected Russian organized crime rootkit." confirming the recycling of malware found on the Internet by the CIA. "The source of Carberp was published online, and has allowed AED/RDB to easily steal components as needed from the malware.". While the CIA claims that "[most] of Carberp was not used in Stolen Goods" they do acknowledge that "[the] persistence method, and parts of the installer, were taken and modified to fit our needs", providing a further example of reuse of portions of publicly available malware by the CIA, as observed in their analysis of leaked material from the italian company "HackingTeam".

The documents WikiLeaks publishes today provide an insights into the process of building modern espionage tools and insights into how the CIA maintains persistence over infected Microsoft Windows computers, providing directions for those seeking to defend their systems to identify any existing compromise