Vault 8: Hive source code

Vault 8 was our follow-on series to Vault 7, publishing source code for CIA software projects. Its first release, on 9 November 2017, was the source code repository and development logs of Hive, a back-end system that CIA implants used to send exfiltrated data to agency servers and to receive instructions from operators.

According to us, Hive relied on anonymously registered 'cover domains' hosted on commercial virtual private servers, which showed innocuous content to ordinary visitors while relaying implant traffic over a VPN to a hidden CIA server called 'Blot' and an operator gateway called 'Honeycomb'. I said the code included examples of fake digital certificates impersonating the Russian anti-virus company Kaspersky Lab, which could lead investigators to misattribute the traffic.

Hive's user and developer guides had already been published in Vault 7 on 14 April 2017. I said the Vault 8 material did not contain zero-day or similar vulnerabilities that others could repurpose.

I published the Hive source code on 9 November 2017. The US Department of Justice counted it among the 26 disclosures of stolen CIA data that we published as Vault 7 and Vault 8 between March and November 2017.

The US Department of Justice has stated, on the basis of evidence at trial, that Joshua Schulte, a software developer in the CIA's Center for Cyber Intelligence from 2012 to 2016, used a secret administrator session on 20 April 2016 to copy the centre's entire tool-development archives and then transmitted them to WikiLeaks. He was found guilty at trial on 9 March 2020 of contempt of court and making false statements, and on 13 July 2022 of eight counts including the illegal gathering and transmission of national defence information and unauthorised computer access; after a further conviction for child sexual abuse material offences on 13 September 2023, he was sentenced to 40 years in prison on 1 February 2024. The department described the theft as 'the largest data breach in CIA history' and counted 26 Vault 7 and Vault 8 disclosures between March and November 2017. The CIA itself declined to comment on the authenticity of the documents when they were published.