The CIA and NyanCat: The hackers and tools of Vault 7's "Year Zero"steemCreated with Sketch.

in wikileaks •  2 years ago

NyanCat may never be looked at the same way again.

This article is meant to comprehensively break down the enormous material of Vault7's "Year Zero" into something more meaningful to readers less familiar with this technical material. Some highlights include the ability to manipulate cars, TVs, and your computer without you ever noticing and having your passwords stored on a "NyanCat".

Vault 7 is a series of WikiLeaks releases on the CIA and the methods and means they use to hack, monitor, control and even disable systems ranging from smartphones, to TVs, to possibly even dental implants. The Vault7 leaks themselves can be found on WikiLeaks.

More Vault 7 research can also be found on the Pizzagate Wiki's Vault 7 page.


The following are the different branches or departments of the CIA Information Operations Center and their purpose as well as the relevant tools or projects they are credited with developing or participating in.

Embedded Development Branch (EDB)


To be the premiere development shop for customized hardware and software solutions for Information Operations: utilizing operating system knowledge, hardware design, software craftsmanship, and network expertise to support the IOC Mission.

Source: WikiLeaks

  • DerStarke
  • YarnBall
  • SnowyOwl
  • HarpyEagle
  • Weeping Angel
  • Gyrfalcon
  • HIVE
  • Sparrowhawk
  • MaddeningWhispers
  • Bee Sting

Remote Development Branch (RDB)


Operational Support Branch (OSB)

  • Flash Bang
  • Fight Club/RickyBobby
  • Taxman
  • Improvise
  • Fine Dining
  • HammerDrill v2.0

Automated Implant Branch (AIB)

  • Assassin
  • Frog Prince
  • Grasshopper

Network Devices Branch (NDB)

  • Perseus/MikroTik

Mobile Development Branch (MDB)

Technical Advisory Council (TAC)

CCI Europe Engineering

Tools and projects

The following are software tools released in Vault7 and used by the CIA along with descriptions of their methods, reasons and implications for employment. They have been organized by the branch of which developed them.


Weeping Angel

Weeping Angel is a complex suite of software which gives the user multiple tools and vectors for attacking, monitoring and listening to a target machine, including Smart TVs.(1)

Weeping Angel is able to:(2)

  • Extract browser credentials or history
  • Extract WPA/WiFi credentials
  • Insert Root CA cert to facilitate MitM of browser, remote access, or Adobe application
  • Investigate the Remote Access feature
  • Investigate any listening ports & their respective services
  • Attempt to override /etc/hosts for blocking Samsung updates without DNS query and iptables (referred to by SamyGo)
  • Add ntpclient update calls to startup scripts to sync implant's system time for accurate audio collection timestamps


Gyrfalcon is a Linux tool that ptraces an OpenSSH client collecting username, password, TCP/IP connections, and session data.(3)


HIVE is a multi-platform CIA malware suite and its associated control software. The project provides customizable implants for Windows, Solaris, MikroTik (used in internet routers) and Linux platforms and a Listening Post (LP)/Command and Control (C2) infrastructure to communicate with these implants.

The implants are configured to communicate via HTTPS with the webserver of a cover domain; each operation utilizing these implants has a separate cover domain and the infrastructure can handle any number of cover domains.

Each cover domain resolves to an IP address that is located at a commercial VPS (Virtual Private Server) provider. The public-facing server forwards all incoming traffic via a VPN to a 'Blot' server that handles actual connection requests from clients. It is setup for optional SSL client authentication: if a client sends a valid client certificate (only implants can do that), the connection is forwarded to the 'Honeycomb' toolserver that communicates with the implant; if a valid certificate is missing (which is the case if someone tries to open the cover domain website by accident), the traffic is forwarded to a cover server that delivers an unsuspicious looking website.

The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer, so the toolserver acts as a C2 (command and control) server for the implant.

Similar functionality (though limited to Windows) is provided by the RickBobby project.

Source: WikiLeaks


Sparrowhawk's goal was to collect user-entered keystrokes from any system terminal, and collate in a unified format across multiple Unix platforms.(4)


HarpyEagle is a tool designed to gain root access on an Apple Airport Extreme and Time Capsule via local and/or remote means to install a persistent rootkit into the flash storage of the devices.(5)

Facedancer21, a component of HarpyEagle, is a client for keyboard emulation. You are able to send keystrokes to the host computer as if you were typing them into a keyboard.(6)


DerStarke appears to be a suite for discretely and persistently monitoring a target device, allowing the attacker to discretely connect to the Internet and thus beacon back to the attacker's device. Unlike typical Windows packages which do similar things, DerStarke was developed for Mac OSX Mavericks.(7)


YarnBall is a client for intercepting USB keyboard traffic for keylogging purposes on primarily Apple devices. The user can then move this data to a discrete storage device curiously labeled as, NyanCat:

Investigate on communication with NyanCat through USB Async/Sync data methods (Would allow larger than 64 byte commands to NyanCat)

Source: WikiLeaks


SnowyOwl is a Mac OS X tool that injects a pthread into an OpenSSH client process creating a surreptitious sub-channel to the remote computer.(8)

Bee Sting

Bee Sting is a discrete tool for injecting data in to iFrame media.(9) This would be coupled with something like Flash Bang to deliver a payload discretely through iFrame media (embedded videos, games, etc.).


MaddeningWhispers is a peculiar set of tools that allow the user to remotely access and beacon a target "Vanguard-based" device. The user is then able to run a command-line client on the target machine and use it as a beacon/listening post and can also manipulate USB devices on the same bus.(10)



The CIA's hand crafted hacking techniques pose a problem for the agency. Each technique it has created forms a "fingerprint" that can be used by forensic investigators to attribute multiple different attacks to the same entity.

This is analogous to finding the same distinctive knife wound on multiple separate murder victims. The unique wounding style creates suspicion that a single murderer is responsible. As soon one murder in the set is solved then the other murders also find likely attribution.

The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation.

With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the "fingerprints" of the groups that the attack techniques were stolen from.

UMBRAGE components cover keyloggers, password collection, webcam capture, data destruction, persistence, privilege escalation, stealth, anti-virus (PSP) avoidance and survey techniques.

Source: WikiLeaks


Flash Bang

Flash Bang is a tool designed to be able to migrate from a browser process (using sandbox breakout), escalate privileges, and memory load a NOD Persistence Spec dll.(11) This basically hacks target system and sets up persistent backdoor through iframe media (embedded videos, games, etc.).

Fight Club/RickyBobby

Fight Club is loaded onto sections of the target system where a set of future actions can be taken. RickyBobby then allows constant monitoring of the network Fight Club is loaded on and performs persistent tasks.(12)

Agents would load a customized malware payload with Fight Club on USB for physical delivery. Software would be loaded onto target's system discretely by disguising itself as WinRAR, VLC Media Player, and more. Nicknames for each, customized payload included MelomyDropkick (TrueCrypt), MelomyRoundhouse (VLC Player), MelomyLeftHook (Shamela) and MelomyKarateChop (WinRar).(13)


Taxman is awesome. 'Nuff said.

Source: WikiLeaks


'Improvise' is a toolset for configuration, post-processing, payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender), MacOS (JukeBox) and Linux (DanceFloor). Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies.

Source: WikiLeaks

Fine Dining

Fine Dining comes with a standardized questionnaire i.e menu that CIA case officers fill out. The questionnaire is used by the agency's OSB (Operational Support Branch) to transform the requests of case officers into technical requirements for hacking attacks (typically "exfiltrating" information from computer systems) for specific operations. The questionnaire allows the OSB to identify how to adapt existing tools for the operation, and communicate this to CIA malware configuration staff. The OSB functions as the interface between CIA operational staff and the relevant technical support staff.

Among the list of possible targets of the collection are 'Asset', 'Liason Asset', 'System Administrator', 'Foreign Information Operations', 'Foreign Intelligence Agencies' and 'Foreign Government Entities'. Notably absent is any reference to extremists or transnational criminals. The 'Case Officer' is also asked to specify the environment of the target like the type of computer, operating system used, Internet connectivity and installed anti-virus utilities (PSPs) as well as a list of file types to be exfiltrated like Office documents, audio, video, images or custom file types. The 'menu' also asks for information if recurring access to the target is possible and how long unobserved access to the computer can be maintained. This information is used by the CIA's 'JQJIMPROVISE' software to configure a set of CIA malware suited to the specific needs of an operation.

Source: WikiLeaks

HammerDrill v2.0

HammerDrill is a CD/DVD collection tool that collects directory walks and files to a configured directory and filename pattern as well as logging CD/DVD insertion and removal events. v2.0 adds a gap jumping capability that Trojans 32-bit executables as they are being burned to disc by Nero. Additionally, v2.0 adds an status, termination and an on-demand collection feature controlled by HammerDrillStatus.dll, HammerDrillKiller.dll and HammerDrillCollector.dll. The logging now also fingerprints discs by hashing the first two blocks of the ISO image, which enables unique identification of multi-sessions discs even as data is added and removed. The log also logs anytime a HammerDrill trojaned binary is seen on a disc.(14)



The exact purpose of this tool is yet unknown, but it was listed under the hacking tools for Automated Implants Branch.(15)

Frog Prince

A tool for testing and manipulating FI implants. Values can also be get and set through Frog Prince, thus the system can be overridden, manipulated and even disabled.(16)


Grasshopper is a modular tool used to install software IO tools on targets running Microsoft Windows operating systems. Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). Installers may be configured with rules that will be evaluated on target to determine whether to conduct an install.(17)



JQJSTEPCHILD appears to be either a tool or a project to discretely exploit and take over Cisco 2911 routers.(18)


The NDB appears to have been involved in trying to exploit vulnerabilities in MikroTik's Hotspot and Paywall networking features and MikroTik routers.(19) It appears these are in use in Latvia and other European countries.(20)

The software tool used to do this appears to have been primarily Perseus.(21)

Authors get paid when people like you upvote their post.
If you enjoyed what you read here, create your account today and start earning FREE STEEM!
Sort Order:  

@RebelSkum, your post has been chosen by @STEEMNEWS.ONLINE as one of today's promoted posts for its excellent content. We've upvoted, resteemed and published it through Facebook & Twitter.

As the author of a SNO featured article, you've been awarded one TRAIL coin. Please stop by the SteemTrail Discord server to learn more about how to claim your TRAIL coin. You will need an Open Ledger account to do so.

STEEMNEWS.ONLINE is the @SteemTrail for #news and watches the #steemnews tag most closely. Please consider supporting excellent news articles by making one of your operators on Streemian, in addition to steemtrail.

Thank you for your hard work and contribution of excellent content to Steemit.

If you would rather not be promoted by STEEMNEWS.ONLINE, please inform us by replying to this comment and we will honor your request.

This is a mighty fine post.


Thanks! As I got to reading the Wiki full of hacking documentation it felt like home, so I just had to do my part of sifting through the nitty-gritty and translating as much as I could in a way that made sense to most people.


There will/should be a lot more unraveling of the technical jargon like this.
Understanding how the C.I.A./Shadow Government/Deep State do it all is going to be the the biggest hurdle for your average everyday Joe on the street.

This is tactical from Wikileaks though. First they release the 'how' its done to
get people on board. Next they will release the 'who' they targeted. Then they will tell us 'why' or the motivations of what they have done/doing.

Whatever it is its going to be fucking big.


The releases of WikiLeaks are ingenious. Folks don't realize that the information is a lot less meaningful when dumped out at once. You have to build an articulate and logical story or else nobody can follow along.

+100 for WikiLeaks


They have done exceptionally well considering the vast amount of pressure they have been under from all the different parties of interest.


Imagine for a second that you are an IQ 150 Autist who can't see their family and has basically been in detention in a house for 7 years for no crime but knowing too much about the real world. You start to get crafty.


Thank you, Wikileaks are a very important part of real intel and security in the world today. The Wikileaks protocol should be well understood by the cyber security community and the crypto community as well.

Great post. Thx. The US have all this fancy spy stuff to use, but took how many years to find Osama Bin Laden? They spend all this money on high tech spy tools but as of yet not every American has a guarantee of healthcare. Priorities?


Let's not even get started on the education system...

But hey, the President's gotta have those $65,000 hotdog parties too. They need to keep up their strength to protect us from the big bad Russians. hawhawhaw

Nice summary of the groups and tools!


Thanks! Now it's all public and on the blockchain so the CIA can just eat its heart out :)

This leak is comprehensive. I made a few collage art works in response to Vault 7

Great work on the vault7 posts, resteeming both :)


Thanks for the support! Just doing my part to translate the nerdspeak :P

This post has been ranked within the top 10 most undervalued posts in the first half of Mar 08. We estimate that this post is undervalued by $12.47 as compared to a scenario in which every voter had an equal say.

See the full rankings and details in The Daily Tribune: Mar 08 - Part I. You can also read about some of our methodology, data analysis and technical details in our initial post.

If you are the author and would prefer not to receive these comments, simply reply "Stop" to this comment.

I'm resteeming this to save for later. Might make a video about it! What do you think are the most interesting or peculiar points that could be addressed?



  1. The wide variety of devices they attempted to hack. Cars, TVs, webcams, websites, implants?, etc.

  2. They seem to have mostly hacked these things without knowledge of the manufacturer, particularly Apple devices.

  3. The CIA was very interested in deceiving investigators, so they would employee techniques and software of rival organizations (like the Russian FSB).

  4. Not just American devices are affected. MikroTik is just one example where the CIA developed tools to take over foreign devices too.

  5. The CIA also developed custom hardware tools, such as the NyanCat, in addition to software. Who knows what kind of crazy embedded devices, and implants, were developed.

There's a lot of good technical stuff in Year Zero, but those are some key points I took from it all.


Thanks for this post, I love the fact that people are finding, spreading and analyzing this very important information about the CIA and how they are affecting the computer economy.

thank you for posting such powerful truthful information


No worries! Nobody likes spinning wheels on undocumented information and it moves us all forward. Just glad I can help!

Good job!


hey bugavi can u resteem my Interview post thanks :)


Thank you kindly! These Vault 7 releases have really put my wiki and research skills to the test!