Skip to content

My personal archive

Last updated: 26 October 2026

THE ASSANGE ARCHIVE.

What I published. What they did about it. What comes next.

Vault 7 · Central Intelligence Agency

UCL / Raytheon

Released by WikiLeaks on 19 July 2017 · View release at WikiLeaks »

Documents that CIA contractor Raytheon Blackbird Technologies submitted for the 'UMBRAGE Component Library' (UCL) project between November 2014 and September 2015. WikiLeaks said they are mostly proof-of-concept ideas and assessments of malware attack vectors, drawing on analyses of malware seen in the wild, for the CIA's Remote Development Branch.

SeriesVault 7
Release date2017-07-19
Documents (per WikiLeaks)41

Documents in this release

TitleDateType
(S//NF) CSIT 15083 -- HTTPBrowser
wikileaks.org
2015-09-11pdf
(S//NF) CSIT 15085 -- NfLog
wikileaks.org
2015-09-11pdf
(S//NF) Symantec -- Regin - Stealthy Surveillance
wikileaks.org
2015-09-11pdf
(S//NF) FireEye -- HammerToss - Stealthy Tactics
wikileaks.org
2015-09-11pdf
(S//NF) VB -- Gamker
wikileaks.org
2015-09-11pdf
(S//NF) SentinelOne - Rombertik
wikileaks.org
2015-09-04pdf
(S//NF) FireEye - Window into Russian Cyber Ops
wikileaks.org
2015-09-04pdf
(S//NF) MalwareBytes -- HanJuan Drops New Tinba
wikileaks.org
2015-09-04pdf
(S//NF) Cisco -- Rombertik
wikileaks.org
2015-09-04pdf
(S//NF) RSA -- Terracotta VPN
wikileaks.org
2015-09-04pdf
(S//NF) Dell SecureWorks -- Sakula
wikileaks.org
2015-08-28pdf
(S//NF) CSIT 15078 -- Skipper Implant
wikileaks.org
2015-08-28pdf
(S//NF) Symantec -- Evolution of Ransomware
wikileaks.org
2015-08-28pdf
(S//NF) CSIT 15079 -- Cozy Bear
wikileaks.org
2015-08-28pdf
(U) McAfee DLL Hijack -- PoC Report
wikileaks.org
2015-08-28pdf
(U) HeapDestroy - DLL Rootkit -- PoC Report
wikileaks.org
2015-08-28pdf
(S//NF) TW -- WildNeutron
wikileaks.org
2015-08-21pdf
(S//NF) NMehta -- Theories on Persistence
wikileaks.org
2015-08-21pdf
(S//NF) CERT-EU -- Kerberos Golden Ticket
wikileaks.org
2015-08-21pdf
(S//NF) VB Dridex 2015 -- Dridex
wikileaks.org
2015-08-21pdf
(S//NF) Symantec -- Black Vine
wikileaks.org
2015-08-14pdf
(S//NF) CSIR 15005 -- Stalker Panda
wikileaks.org
2015-08-14pdf
(S//NF) CSIT 15016 -- Elirks RAT
wikileaks.org
2015-08-14pdf
(S//NF) Eset -- Liberpy
wikileaks.org
2015-08-14pdf
(S//NF) Eset -- Potao
wikileaks.org
2015-08-14pdf
(U) Sinowal Web Form Scraping -- PoC Report
wikileaks.org
2015-08-07pdf
(S//NF) MIRcon -- Something About WMI
wikileaks.org
2015-08-07pdf
(U) PoC Report -- Anti-Debugging and Anti-Emulation
wikileaks.org
2015-08-07pdf
(S//NF) SY 2015 -- Butterfly Attackers
wikileaks.org
2015-08-07pdf
(S//NF) Symantec -- ZeroAccess Indepth
wikileaks.org
2015-08-07pdf
(S//NF) CI 2015 -- PlugX 7.0
wikileaks.org
2015-08-07pdf
(U) Mimikatz Password Scanning Analysis -- PoC Report
wikileaks.org
2015-08-07pdf
(S//NF) TrendMicro -- Understanding WMI Malware
wikileaks.org
2015-08-07pdf
(S//NF) CanSecWest 2013 -- DEP/ASLR Bypass Without ROP/JIT
wikileaks.org
2015-08-04pdf
(U) Software Restriction Policy: A/V Disable -- PoC Report
wikileaks.org
2015-06-26pdf
(U) WMI Persistence Proof of Concept -- Supplemental Report
wikileaks.org
2015-06-26pdf
(U) Mimikatz PoC Report
wikileaks.org
2015-05-29pdf
(U) Pony / Fareit PoC Report
wikileaks.org
2015-05-29pdf
(U) SIRIUS Pique Proof-of-Concept Delivery -- User-Mode DKOM -- Final PoC Report
wikileaks.org
2015-01-26pdf
(U) SIRIUS Pique Proof-of-Concept Delivery -- Direct Kernel Object Manipulation (DKOM) -- Interim PoC Report
wikileaks.org
2014-12-29pdf
(U) Direct Kernel Object Manipulasiton (DKOM) -- Proof-of-Concept (PoC) Outline
wikileaks.org
2014-11-21pdf