Security Experts:

Connect with us

Hi, what are you looking for?



WikiLeaks Details MitM Attack Tool Used by CIA

WikiLeaks has released documents detailing a man-in-the-middle (MitM) attack tool allegedly used by the U.S. Central Intelligence Agency (CIA) to target local networks.

WikiLeaks has released documents detailing a man-in-the-middle (MitM) attack tool allegedly used by the U.S. Central Intelligence Agency (CIA) to target local networks.

The tool, initially called Fulcrum and later renamed Archimedes by its developers, can be used to conduct MitM attacks within a local area network (LAN). The leaked documents, dated between 2011 and 2014, describe it as a tool that allows the user to redirect LAN traffic from a targeted computer through an attacker-controlled machine before it’s passed on to the gateway.

“This enables the tool to inject a forged web-server response that will redirect the target’s web browser to an arbitrary location. This technique is typically used to redirect the target to an exploitation server while providing the appearance of a normal browsing session,” developers wrote in the tool’s user guide.

Jake Williams, founder of Rendition Infosec and SANS instructor, analyzed the leaked documents and determined that the tool appears to be a repackaged version of Ettercap, a popular MitM tool.

While the tool’s capabilities are not impressive, Williams pointed out that potential targets of the CIA can use the leaked information to see if their systems had been targeted by the agency.

A more interesting tool, including its source code, was published by WikiLeaks last week. The project, dubbed Scribbles, is designed for inserting special watermarks into documents that may be copied by insiders and whistleblowers.

The first major version of the Scribbles tool was released in March 2016 and it may have been developed by the CIA to identify people such as Edward Snowden, who in 2013 leaked a massive amount of information on the NSA’s surveillance capabilities.

WikiLeaks has already released numerous documents as part of its “Vault 7” dump. In the past weeks, the whistleblower organization has made public documents describing various tools, including ones for hacking Samsung smart TVs, a framework used to make attribution and analysis of malware more difficult, and a platform designed for creating custom malware installers.

Many of the tools are outdated and the vulnerabilities they leverage have already been patched. However, the leaked information can be very useful for entities that may have been targeted with these exploits.

In fact, researchers at Symantec and Kaspersky have found links between the tools exposed by Wikileaks and the malware used by a cyber espionage group tracked as Longhorn and The Lamberts.

Related: If the CIA Isnt’ Secure, Who Is?

Related: Arrest of WikiLeaks’s Assange a ‘Priority’, Says US Top Cop

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...