Cyber-intelligence documentation and source code
Vault 7
First published 7 March 2017 · Central Intelligence Agency · 8,761 documents and files in Year Zero; 26 releases in all (Mar–Nov 2017)
Our 2017 series on the CIA's hacking tools. A former CIA developer was convicted of stealing the material and giving it to us.
Overview
Internal material from the CIA's Center for Cyber Intelligence, the unit that builds the agency's hacking tools. Year Zero, our first and largest release on 7 March 2017, carried 8,761 documents and files from the centre's development network covering 2013 to 2016. Further releases through September 2017 documented individual projects targeting computers, phones and smart TVs. Vault 8, from November 2017, published source code.
We withheld functional cyber-weapons and redacted tens of thousands of IP addresses and other identifiers. Joshua Schulte, a former CIA developer, was convicted in 2022 of stealing the archive in 2016 and sent down for 40 years. The DOJ called it the largest data breach in CIA history.
What reporting revealed
- CIA tools in Year Zero targeted iPhones, Android phones, Windows PCs and Samsung smart TVs.
- Weeping Angel, an implant turning Samsung TVs into covert microphones, was built jointly with Britain's MI5.
- CIA hackers for Europe, the Middle East and Africa worked from the US consulate in Frankfurt under diplomatic cover.
- Apple said the iPhone flaw in Dark Matter had been fixed in 2009 and the Mac flaws in all Macs after 2013.
- The DOJ said the disclosures cost the CIA hundreds of millions of dollars.
Documents
| Released | Release | Summary | Files |
|---|---|---|---|
| 2017-11-09 | Hive Vault 8 | Source code and development logs for Hive, which WikiLeaks described as a major part of the CIA's infrastructure for controlling its malware, relaying implant traffic via cover domains to a hidden server. WikiLeaks said the code shows certificates generated to impersonate Kaspersky Laboratory. | 8 |
| 2017-09-07 | Protego Vault 7 | Four documents from the CIA's Protego project together with 37 related manuals from Microchip Technology Inc., according to WikiLeaks. WikiLeaks described Protego as a PIC-based missile control system developed by Raytheon rather than a typical malware project. | 41 |
| 2017-08-31 | Angelfire Vault 7 | Documents on 'Angelfire', which WikiLeaks described as a persistent CIA implant framework for Windows XP and Windows 7 made up of five components: Solartime, Wolfcreek, Keystone, BadMFS and the Windows Transitory File system. Targets: Windows | 5 |
| 2017-08-24 | ExpressLane Vault 7 | Documents on 'ExpressLane', which WikiLeaks described as a covert CIA tool for secretly extracting data from biometric collection systems that the CIA's Office of Technical Services provides to liaison services. WikiLeaks said it is installed under cover of a biometric software upgrade. Targets: Biometric collection systems | 6 |
| 2017-08-10 | CouchPotato Vault 7 | The user guide for 'CouchPotato', which WikiLeaks described as a CIA remote tool for collecting RTSP/H.264 video streams, saving either video files or still images of frames that change significantly. Targets: RTSP/H.264 video streams | 1 |
| 2017-08-03 | Dumbo Vault 7 | Documents on 'Dumbo', which WikiLeaks described as a CIA tool, run from a USB stick, that identifies webcams and microphones on a Windows computer and lets the operator stop or corrupt their recordings during physical-access operations. Targets: Windows | 8 |
| 2017-07-27 | Imperial Vault 7 | Documents from the CIA's Imperial project covering three tools, according to WikiLeaks: Achilles, for trojanising OS X disk-image installers; SeaPea, an OS X rootkit; and Aeris, an implant for several POSIX-based systems. Targets: macOS, Debian, RHEL, Solaris, FreeBSD, CentOS | 3 |
| 2017-07-19 | UCL / Raytheon Vault 7 | Documents that CIA contractor Raytheon Blackbird Technologies submitted for the 'UMBRAGE Component Library' (UCL) project between November 2014 and September 2015. WikiLeaks said they are mostly proof-of-concept ideas and assessments of malware attack vectors, drawing on analyses of malware seen in the wild, for the CIA's Remote Development Branch. | 41 |
| 2017-07-13 | Highrise Vault 7 | The user guide for 'HighRise', which WikiLeaks described as a CIA Android application (for Android 4.0 to 4.3) that acts as an SMS proxy between devices in the field and an internet listening post. Targets: Android | 1 |
| 2017-07-06 | BothanSpy Vault 7 | Documents on two CIA implants that, according to WikiLeaks, steal SSH credentials: BothanSpy, which targets the Xshell client on Windows, and Gyrfalcon, which targets the OpenSSH client on Linux. Targets: Windows, Linux | 3 |
| 2017-06-30 | OutlawCountry Vault 7 | Documents on 'OutlawCountry', which WikiLeaks described as a CIA kernel module for Linux that creates a hidden netfilter table, letting an operator redirect a target's outbound network traffic to CIA-controlled machines. Targets: Linux | 2 |
| 2017-06-28 | Elsa Vault 7 | The user manual for the CIA's ELSA project, which WikiLeaks described as geolocation malware for Wi-Fi-enabled Windows devices such as laptops; it records nearby Wi-Fi access points so that the device's location can be worked out later. Targets: Windows | 1 |
| 2017-06-22 | Brutal Kangaroo Vault 7 | Documents on 'Brutal Kangaroo', which WikiLeaks described as a CIA tool suite for Microsoft Windows that reaches closed, air-gapped networks by infecting USB thumb drives, then builds a covert network among the infected machines. Targets: Windows, Air-gapped networks | 11 |
| 2017-06-15 | Cherry Blossom Vault 7 | Documents on the CIA's CherryBlossom project, which WikiLeaks said was developed with SRI International. WikiLeaks described it as a means of compromising wireless routers and access points with custom firmware in order to monitor and manipulate the internet traffic of targeted users. Targets: Wireless routers, Wi-Fi access points | 59 |
| 2017-06-01 | Pandemic Vault 7 | Documents on 'Pandemic', which WikiLeaks described as a persistent CIA implant for Windows machines that share files on a local network; it swaps requested programs for trojaned versions while they are in transit to remote users. Targets: Windows | 5 |
| 2017-05-19 | Athena Vault 7 | Documents on the CIA's 'Athena' project, which WikiLeaks described as malware giving remote beacon and loader capabilities on Windows computers from Windows XP to Windows 10. WikiLeaks said the documentation shows it was developed with the US firm Siege Technologies. Targets: Windows | 30 |
| 2017-05-12 | AfterMidnight Vault 7 | Documents on two CIA malware frameworks for Microsoft Windows, 'AfterMidnight' and 'Assassin'. According to WikiLeaks, AfterMidnight loads and runs payloads called 'Gremlins' on a target machine, while Assassin is an automated implant that beacons to listening posts for tasking. Targets: Windows | 13 |
| 2017-05-05 | Archimedes Vault 7 | Documents on 'Archimedes', which WikiLeaks described as a CIA tool for attacking computers on a local area network by routing their traffic through an infected, CIA-controlled machine, for example to send a target's web browser to an exploitation server. Targets: Local area networks (LAN) | 9 |
| 2017-04-28 | Scribbles Vault 7 | Documentation and source code for the CIA's 'Scribbles' project, which WikiLeaks described as a tool for embedding web-beacon-style watermarks in Microsoft Office documents that might be passed on by insiders, whistleblowers or journalists. The released version (v1.0 RC1) is dated 1 March 2016, according to WikiLeaks. Targets: Microsoft Office documents | 4 |
| 2017-04-21 | Weeping Angel Vault 7 | The user guide for 'Weeping Angel', which WikiLeaks described as a CIA implant for Samsung F Series smart TVs that records audio from the built-in microphone. WikiLeaks said it was based on the 'Extending' tool of the UK's MI5/BTSS and developed further by both agencies. Targets: Samsung F Series smart TVs | 1 |
| 2017-04-14 | Hive Vault 7 | Six documents on the CIA's HIVE project from its Embedded Development Branch. WikiLeaks described HIVE as back-end infrastructure through which CIA implants send exfiltrated data and receive commands over HTTPS, hidden behind innocuous-looking cover domains. | 6 |
| 2017-04-07 | Grasshopper Vault 7 | 27 documents on the CIA's Grasshopper framework, which WikiLeaks described as a platform for building customised malware payloads for Microsoft Windows from modules, with rules for surveying a target before installation. WikiLeaks highlighted that one persistence module, 'Stolen Goods', took components from the Carberp malware, according to the documents. Targets: Windows | 27 |
| 2017-03-31 | Marble Framework Vault 7 | Source code (676 files, according to WikiLeaks) for the CIA's Marble Framework, which WikiLeaks described as an anti-forensic tool that obfuscates text strings in CIA malware to make attribution harder. WikiLeaks noted that the code also contains a deobfuscator and test examples in several languages. | 2 |
| 2017-03-23 | Dark Matter Vault 7 | Documentation for several CIA projects from its Embedded Development Branch that, according to WikiLeaks, infect Apple Mac firmware so that the infection survives a reinstall of the operating system. Tools covered include Sonic Screwdriver, DarkSeaSkies, Triton and DerStarke, plus the iPhone tool NightSkies. Targets: macOS, Mac EFI/UEFI firmware, iOS | 13 |
| 2017-03-07 | Year Zero Vault 7 | The first and largest part of the Vault 7 series. According to WikiLeaks, it consists of 8,761 documents and files taken from a segregated, high-security CIA network at the agency's Center for Cyber Intelligence, mostly pages from an internal Confluence wiki, and that it describes the agency's hacking programme, malware and 'zero day' exploits against products including iPhones, Android phones, Windows and Samsung TVs. Targets: iOS, Android, Windows, macOS, Linux, Solaris, Routers, Samsung smart TVs | 8761 |
Source: wikileaks.org/vault7/ · retrieved 26 October 2026.
Catalogue records
Entries describing the release and related documents, with provenance and sources.
| Published | Cat. no. | Title | Type |
|---|---|---|---|
| 2017-11-09 | FAN-0034 | Vault 8: Hive source code Source code and development logs for Hive, the CIA's covert infrastructure for controlling its malware, which I published on 9 November 2017 as the first release of our Vault 8 series. | Source code |
| 2017-04-21 | FAN-0032 | Vault 7: 'Weeping Angel' (Samsung smart TV implant) User guide for 'Weeping Angel', a CIA implant that turned Samsung smart TVs into covert microphones, based on an MI5 tool; first revealed in Year Zero and published in full on 21 April 2017. | Technical documentation |
| 2017-03-31 | FAN-0031 | Vault 7: Marble Framework 676 source code files for the CIA's Marble Framework, a tool for obscuring text in malware to hinder forensic attribution, which I published on 31 March 2017. | Source code |
| 2017-03-23 | FAN-0030 | Vault 7: 'Dark Matter' CIA documentation on implants designed to persist in the firmware of Apple Mac computers and on iPhones, developed by the Embedded Development Branch; I published it on 23 March 2017. | Technical documentation |
| 2017-03-07 | FAN-0029 | Vault 7: 'Year Zero' The first Vault 7 release: 8,761 documents and files from the CIA's Center for Cyber Intelligence describing the agency's hacking tools and methods, which I published on 7 March 2017. | Technical documentation |
Source
- Vault 7 — original release — wikileaks.org (Original publication)wikileaks.org