Symantec he said that he has been able to link at least 40 16-targeted attacks to the 7 countries with tools that first announced WikiLeaks through Vault XNUMX that reveals the CIA's spying tactics.
In a lengthy report, Symantec talks about a well-organized group called Longhorn and, according to the security company, made those attacks. The company emphasizes that Longhorn is made up of CIA agents, and has plenty of evidence.
"The tools used by Longhorn follow exactly the development schedule and technical specifications set out in the documents published by Wikileaks. The Longhorn team shares the same encryption protocols set out in the Vault 7 documents, except that they follow the same tactics guidelines to avoid detection. "Given the similarities between the tools and the techniques, there can be no doubt that Longhorn's activities and the documents that leaked through Vault 7 are the work of the same team," the security company said.
Who's on Longhorn?
Longhorn is a team that works at least from 2011, using a series of backdoors trojans and zero-day vulnerabilities to gain access to its goals. The group has managed to penetrate into governmental organizations and companies with international activity. Its targets are corporations and governmental organizations that deal with finance, telecommunications, energy, aerospace, information technology, education, natural resources, Symantec says, but does not name them precisely.
These targets were in 16 countries across the Middle East, Europe, Asia and Africa. Once, a computer was infected in the United States, but the malware was uninstalled within a few hours, indicating that the infection was probably inadvertently.
As soon as WikiLeaks began publishing the CIA files, Symantec found that some of these documents contained information closely related to the development of a Longhorn tool called Corentry trojan. Symantec has announced that the tool has new features it discovered when it was able to collect more samples.
Symantec reports that it has detected Longhorn from 2014 when it drew its attention by using a zero-day exploit that had been embedded in a Word document. Other malware used by Longhorn is Corentry, Backdoor.Trojan.LH1, and Backdoor.Trojan.LH2.
Prior to WikiLeaks revelations, Symantec believed that Longhorn was a very good fundraising team dealing with information gathering operations. Time stamps for the team's work show that hackers are working from Monday to Friday, making it quite clear that the group was a state agency.
