Skip to main content

Brutal Kangaroo

WikiLeaks

Today, June 22nd 2017, WikiLeaks publishes documents from the Brutal Kangaroo project of the CIA. Brutal Kangaroo is a tool suite for Microsoft Windows that targets closed networks by air gap jumping using thumbdrives. Brutal Kangaroo components create a custom covert network within the target closed network and providing functionality for executing surveys, directory listings, and arbitrary executables.

The documents describe how a CIA operation can infiltrate a closed network (or a single air-gapped computer) within an organization or enterprise without direct access. It first infects a Internet-connected computer within the organization (referred to as "primary host") and installs the BrutalKangaroo malware on it. When a user is using the primary host and inserts a USB stick into it, the thumbdrive itself is infected with a separate malware. If this thumbdrive is used to copy data between the closed network and the LAN/WAN, the user will sooner or later plug the USB disk into a computer on the closed network. By browsing the USB drive with Windows Explorer on such a protected computer, it also gets infected with exfiltration/survey malware. If multiple computers on the closed network are under CIA control, they form a covert network to coordinate tasks and data exchange. Although not explicitly stated in the documents, this method of compromising closed networks is very similar to how Stuxnet worked.

The Brutal Kangaroo project consists of the following components: Drifting Deadline is the thumbdrive infection tool, Shattered Assurance is a server tool that handles automated infection of thumbdrives (as the primary mode of propagation for the Brutal Kangaroo suite), Broken Promise is the Brutal Kangaroo postprocessor (to evaluate collected information) and Shadow is the primary persistence mechanism (a stage 2 tool that is distributed across a closed network and acts as a covert command-and-control network; once multiple Shadow instances are installed and share drives, tasking and payloads can be sent back-and-forth).

The primary execution vector used by infected thumbdrives is a vulnerability in the Microsoft Windows operating system that can be exploited by hand-crafted link files that load and execute programs (DLLs) without user interaction. Older versions of the tool suite used a mechanism called EZCheese that was a 0-day exploit until March 2015; newer versions seem use a similar, but yet unknown link file vulnerability (Lachesis/RiverJack) related to the library-ms functionality of the operating system.

Links, documents:

Comments

Post a Comment

Popular posts from this blog

How The CIA & Mossad Set Up Sudan for Genocide since the 1990s

MintPress News   Sudan is being systematically destroyed - not by accident, but by design. This investigation reveals how US imperialism, through Israeli and UAE proxies, has engineered Sudan's collapse since the 1990s to crush the axis of resistance, block China's Belt and Road, and loot Africa's resources families are killed, children starve, and the west profits. 
Post a Comment
Read more

Capitalism & Genocide - Yanis Varoufakis Speech at the Gaza Tribunal, 23rd October 2025, Istanbul

Yanis Varoufakis   On 23rd October, Yanis Varoufakis testified in front of the Jury of Conscience in the context of the Gaza Tribunal. His speech focused on the economic forces underpinning the genocide of the Palestinian people. In particular, he spoke on the manner in which capitalist dynamics have historically fuelled the white settler colonial project and, more recently, how the accumulation of a new form of capital - which he calls cloud capital - has accelerated, deepened and amplified the economic forces powering and propelling the machinery of genocide. 
Post a Comment
Read more

Trump Welcomes Syrian Leader & “REFORMED” TERRORIST To White House!

The Jimmy Dore Show   President Donald Trump is planning a White House welcome for Syria’s new president, former al-Qaeda in Iraq leader Ahmed al-Sharaa, who was installed after the overthrow of Bashar al-Assad. Jimmy Dore argues that the U.S. and its allies, including Israel, have long funded extremist groups such as ISIS and al-Qaeda to serve foreign policy interests in the Middle East, so the embrace of al-Sharaa makes sense, even if it might confuse anyone who thought we took seriously the so-called “War on Terror.” He and Americans’ Comedian Kurt Metzger contrast Trump’s willingness to meet with alleged terrorists to his refusal to engage in dialogue with leaders like Venezuela’s Nicolás Maduro, accusing U.S. policy of hypocrisy and imperialism.  
Post a Comment
Read more

Greece, Palestine & Zionism: FPTV Reports from Athens

Free Palestine TV   Laith Marouf & Rabih Ghannam travel to Athens, Greece, and take a walking tour with local activists Evan Katsounis and Maria Kosmidi, to discover the rich history of anti-Zionist and anti-Fascist actions in the city, as well as the current Zionist incursion into the property sector and the counter actions directed at the presence of these War Criminals on the streets of the city. 
Post a Comment
Read more

Trump BLEW IT: Israel, Candace Owens & Epstein BURY MAGA (But Not How You Think)

Danny Haiphong   Trump has bent the knee to Israel for the last time. Patrick Henningsen exposes his horrid record and all the elements that has led to his rapidly coming collapse. 
Post a Comment
Read more

Zionists’ LONG HISTORY Of False Flags & STAGED Attacks!

The Jimmy Dore Show   In recent years several alleged anti-Semitic incidents, including graffiti and vandalism, were later revealed to have been staged or “false flag” operations carried out by Jewish perpetrators to create sympathy or shift the public narrative in Israel’s favor. Jimmy Dore presents investigations that revealed hoaxes and uses them to argue that media and political institutions exploit victimhood to silence criticism of Israel. He then expands the discussion to accuse Israeli and Zionist figures of deceit in global politics and misinformation about Gaza. It ends with commentary that the term “anti‑Semitic” has lost meaning due to its politicization and misuse.
Post a Comment
Read more

Will Mamdani manage to liberate New York from brutal neoliberalism?

globinfo freexchange    Fifty years ago, New York City was on the verge of collapse . The politicians who run the city had borrowed more and more money from the banks to pay for its growing services and welfare. But in the early 70s, the middle classes fled from the city and the taxes they paid disappeared with them. So, the banks lent the city even more. But then, they began to worry about the size of the growing debt and whether the city would ever be able to pay it back. And then, one day in 1975, the banks just stopped.   The city held its regular meeting to issue bonds in return for the loans, overseen by the city's financial controller. The banks were supposed to turn up at 11 a.m., but it soon became clear that none of them were going to appear. The meeting was rescheduled for 2 p.m. and the banks promised they would turn up. What happened that day in New York, marked a radical shift in power. The banks insisted that in order to protect their loans, they sho...
Post a Comment
Read more

A response to misinformation on Nicaragua: it was a coup, not a ‘massacre’

There is so much misinformation in mainstream corporate media about recent events in Nicaragua that it is a pity that Mary Ellsberg’s article for Pulse has added to it with a seemingly leftish critique. Ellsberg claims that recent articles, including from this website, often “ paint a picture of the crisis in Nicaragua that is dangerously misleading. ” Unfortunately, her own article does just that. It looks at the situation entirely from the perspective of those opposing Daniel Ortega’s government while whitewashing their malevolent behavior and downplaying the levels of US support they have relied on. Her piece is an incomplete depiction of what is happening on the ground, ignoring many salient facts that have come to light and which have been outdated by recent events. The following is a brief response to Ellsberg’s main points from someone who lives in Nicaragua and has observed the situation directly and intimately: https://grayzoneproject.com/2018/08/15/a-res...
Post a Comment
Read more

Priceless: Zelensky told the truth about the war in Ukraine at its beginning!

globinfo freexchange    How did this escape the radars of mainstream media? Well, the answer is obvious, yet still, it is astonishing the fact that already back in 2022, at the beginning of the war in Ukraine, one of the major outlets of Western imperialism, actually translated this part of the interview with West's puppet, Volodymyr Zelensky. At 12:28 of the video, Zelensky starts spelling the truth about the real reason behind the war in Ukraine!    Zelensky admits:                            There are those in the West who don't mind a long war because it would mean exhausting Russia, even if this means the demise of Ukraine and the cost of Ukrainian lives. This is definitely in the interest of some countries. For other countries, it would be better if the war ended quickly because Russia's market is big one that their economies are su...
Post a Comment
Read more

Trump RUINED: Israel First Lies & Economic Freefall Just ENDED MAGA

Danny Haiphong   Tucker Carlson isn't the only journalist breaking with Trump. In this video, Patrick Henningsen goes scorched earth on Trump's massive betrayal of what he promised his "MAGA" base and blows the lid off how his massive lies serve as a cover up for a much bigger structural problem in America's 'Israel First' political system, what Tucker and major voices in elite MAGA won't tell you.  
Post a Comment
Read more