What Is Vault 7? CIA Hacking Tools, WikiLeaks Leak, and Fallout

Vault 7 is the name WikiLeaks gave to a series of leaked internal CIA documents it began publishing on March 7, 2017, exposing the agency’s cyber espionage tools and hacking capabilities. The first installment alone contained 8,761 files from the CIA’s Center for Cyber Intelligence, and WikiLeaks described the series as the largest intelligence publication in its history.¹ The documents showed that the CIA had built malware, zero-day exploits, and remote surveillance tools capable of compromising smartphones, desktop computers, routers, smart televisions, and even networks intentionally disconnected from the internet. The former CIA software engineer identified as the source, Joshua Schulte, was convicted of espionage and sentenced to 40 years in federal prison in February 2024.²

What the Documents Covered

The material spanned roughly 2013 to 2016 and had been taken from what WikiLeaks described as an isolated, high-security network inside the Center for Cyber Intelligence before circulating among former government hackers and contractors.³¹⁴ A follow-up series called Vault 8, launched in November 2017, did publish source code for one of the CIA’s central platforms, HIVE.⁵

The published files were documentation, not ready-to-use attack code. That distinction matters, and security researchers returned to it often: Vault 7 gave adversaries a detailed education in CIA methods and tradecraft rather than handing them working weapons.⁶

The Tools That Were Revealed

Weeping Angel: Smart TVs as Microphones

The disclosure that drew the most public attention was Weeping Angel, a tool developed with Britain’s MI5 to target Samsung F8000-series smart TVs. Installed via USB, it placed the television into a “Fake-Off” mode where the screen appeared powered down while the built-in microphone recorded room audio and sent it to a CIA server. A blue LED on the back of the set stayed lit during Fake-Off mode, and CIA developers were working on ways to suppress it. The documents also described plans to capture video from the TV’s camera, hijack its browser, and block firmware updates that would close the vulnerability. Samsung said protecting consumer privacy was a top priority, that it was urgently looking into the matter, and that the affected firmware was on TVs sold in 2012 and 2013, “most of which have already been patched through a firmware update.”⁷

Phone and Computer Exploits

The documents cataloged numerous iOS and Android vulnerabilities. On Apple hardware, a project called Dark Matter described firmware-level Mac infections that persisted through a full operating system reinstall, including a tool called Sonic Screwdriver that could run code from peripheral devices at boot even with a firmware password set. Separate iPhone projects appeared under code names like Elderpiggy and Juggernaut. On Windows, a framework called Grasshopper let operators assemble customized malware payloads designed to evade Microsoft security tools and stay resident on target machines.³⁸

One point of confusion in early coverage is worth flagging. Reporting initially suggested that end-to-end encrypted messengers like WhatsApp and Signal had been broken. They had not. The CIA’s exploits targeted the underlying mobile operating systems, which lets an attacker read messages on a compromised phone without defeating the encryption itself.³

Routers and Air-Gapped Networks

A framework called Cherry Blossom compromised wireless routers and access points by installing custom firmware, letting operators monitor traffic, redirect users, and inject malicious content. Brutal Kangaroo went after air-gapped networks, using infected USB thumb drives to move malware across computers that were deliberately kept off the internet. OutlawCountry was a Linux kernel module that redirected outbound traffic from targeted machines to CIA-controlled servers.⁸⁹

Marble Framework: Hiding the CIA’s Fingerprints

Released March 31, 2017, as 676 source-code files, the Marble Framework was an anti-forensics tool. It scrambled text strings inside CIA malware so analysts could not easily trace a sample back to the agency or to a particular developer. It also included algorithms that inserted foreign-language strings — Chinese, Russian, Korean, Arabic, and Farsi — that could push investigators toward a false attribution. WikiLeaks compared the tool to placing covers over English-language text on U.S.-made weapons before handing them to insurgents. A deobfuscation utility included with the archive could reverse the process, meaning analysts could in principle use it to re-attribute previously disguised operations.¹⁰¹¹

UMBRAGE: Borrowing Other Countries’ Malware

UMBRAGE, a group inside the CIA’s Remote Devices Branch, maintained a library of attack techniques lifted from malware produced by other states, including Russia. The library covered keyloggers, password harvesters, webcam capture, data destruction, persistence, and sandbox evasion. Specific borrowings included the disk-wiping method from Shamoon (repurposed as an internal tool called Rebound), persistence techniques from the HiKit rootkit, and code inspired by the 2015 Hacking Team breach. The dual benefit was expanding the arsenal cheaply while leaving behind other groups’ forensic fingerprints.¹¹²

HIVE: The Command-and-Control Backbone

HIVE was the infrastructure tying many CIA implants together, and its full source code was later published in the November 2017 Vault 8 release. Multi-platform, it supported implants on Windows, Linux, Solaris, and MikroTik routers. Traffic from compromised machines was routed through innocent-looking cover domains on rented commercial servers, forwarded by VPN to a hidden CIA server called Blot, and passed on to an operator gateway called Honeycomb. The CIA also generated fraudulent digital certificates impersonating real companies; the leaked code included examples issued in the name of Kaspersky Laboratory in Moscow, which would push targets toward blaming the Russian security firm for suspicious network activity.⁵¹³

ExpressLane: Spying on Partner U.S. Agencies

ExpressLane, developed by the CIA’s Office of Technical Service, secretly collected biometric data from partner agencies including the FBI, NSA, and Department of Homeland Security. CIA officers installed the tool during what were presented as routine software upgrades on biometric collection systems supplied by the firm CrossMatch. A fake progress bar mimicked a normal Windows installation while the tool compressed, encrypted, and copied biometric data to a hidden partition on a watermarked USB drive. A built-in kill date, defaulting to six months, would disable the host software unless a CIA agent returned to extend the license, which effectively forced continued access.¹⁴

Who Leaked the Files

The FBI and CIA traced the breach to Joshua Adam Schulte, a software developer inside the Center for Cyber Intelligence. Prosecutors said Schulte stole the data in 2016 using a backdoor password and then manipulated digital logs to cover his tracks. U.S. Attorney Damian Williams called the leak “one of the most brazen and damaging acts of espionage in American history,” saying it rendered intelligence tools useless and gave “critical intelligence to those who wish to do us harm.”¹⁵

Schulte was arrested in 2018. His first trial in 2020 ended in a mistrial after the jury deadlocked on the espionage counts, convicting him only of contempt and making false statements to the FBI.¹⁶ A retrial in July 2022 produced convictions on nine counts, including violations of the Espionage Act and the Computer Fraud and Abuse Act.¹⁷ A separate trial in September 2023 convicted him of receipt, possession, and transportation of child sexual abuse images that had been found during a search of his apartment.¹⁸

On February 1, 2024, U.S. District Judge Jesse M. Furman sentenced Schulte to 40 years in federal prison followed by lifetime supervised release. Of that, 33 years and four months were attributed to the espionage and hacking convictions and the balance to the child exploitation charges. Judge Furman described Schulte’s actions as a “digital Pearl Harbor” that had done “untold damage to national security,” and said Schulte had been “motivated by anger, spite and perceived grievance.”¹⁷ Schulte denied the allegations throughout, saying he had acted out of patriotism. Even in custody he tried to leak more classified material, smuggling a phone into jail to contact a reporter and to draft social media posts about CIA cyber tools.¹⁶

How the Industry and the CIA Responded

The clearest technical response came from Cisco, which opened its own investigation after the first release and identified a critical vulnerability, CVE-2017-3881, in the Cluster Management Protocol code of its IOS and IOS XE software affecting more than 300 switch models. The flaw let a remote, unauthenticated attacker run arbitrary code or crash devices. Cisco issued mitigation guidance in mid-March 2017, advising customers to disable Telnet and use SSH, and released a full patch in May 2017. The company said it had found the vulnerability through its own analysis, without help from WikiLeaks.¹⁹²⁰

Apple said many of the iOS vulnerabilities described in the documents had already been patched in the current version of its operating system. Google said existing Chrome and Android updates already protected users against many of the documented exploits, though its analysis was continuing. Microsoft said it was aware of the report and looking into it. WikiLeaks founder Julian Assange said the organization would give affected companies exclusive access to technical details so they could develop patches before broader disclosure.²¹

Inside the CIA, a classified internal review ordered by then-Director Mike Pompeo and later reported by the New York Times in June 2020 was blunt. A WikiLeaks task force found that the agency had failed to implement “common security standards” and lacked “basic monitoring of who had access to its information.” Because of those gaps, the CIA could not “determine the precise scope of the loss.” The report criticized a culture that prized building cutting-edge cyberweapons but “spent too little energy protecting those tools.”²² The CIA and NSA later tightened internal controls, restricted personnel access to sensitive cyber tools, and stepped up background checks.²³

The Debate Over Stockpiling Vulnerabilities

Vault 7 revived a running policy argument over whether U.S. intelligence agencies should report software vulnerabilities to vendors or keep them for offensive use. The government’s Vulnerabilities Equities Process had been described by officials as strongly biased toward disclosure, and NSA Director Admiral Mike Rogers had said, “by orders of magnitude, the greatest number of vulnerabilities we find, we share.”²⁴

Critics were unconvinced. Cybersecurity researcher Jason Healey suggested the CIA’s tools relied on older vulnerabilities used outside the United States and may not have been subject to the process at all. Robert Graham called the process “nonsense” and a public-relations exercise, arguing intelligence agencies would never voluntarily destroy the value of vulnerabilities that cost millions to acquire.²⁴ The leak also confirmed that the CIA shared vulnerabilities with the NSA and FBI and with foreign partners like MI5 and GCHQ, and that it bought exploits from private contractors under code names such as Baitshop.²⁵ The underlying concern, as several analysts framed it, was that hoarding vulnerabilities left the same holes open for adversaries to find, so the public was less secure on balance. Assange raised the point in similar terms, warning of “extreme proliferation risk in the development of cyber weapons.”⁶

1
WikiLeaks. Vault 7: CIA Hacking Tools Revealed
2
NPR. Former CIA Engineer Sentenced to 40 Years for WikiLeaks Leak
3
Wired. CIA Files WikiLeaks Vault 7
4
Cisco Blogs. The WikiLeaks Vault 7 Leak: What We Know So Far
5
WikiLeaks. Vault 8
6
The Conversation. WikiLeaks Vault 7 Reveals Staggering Breadth of CIA Hacking
7
Consumer Reports. A Closer Look at the TVs From the CIA Vault 7 Hack
8
Infosec Institute. Vault 7 Data Leak: Analyzing CIA Files Released Since March
9
WikiLeaks. Vault 7
10
The Hacker News. CIA Marble Framework
11
Security Affairs. Vault 7 Marble Framework
12
Infosec Institute. WikiLeaks Vault 7 Data Leak: Another Earthquake in the Intelligence Community
13
The Hacker News. CIA HIVE Malware Code
14
SecurityWeek. WikiLeaks: CIA Secretly Collected Data From Liaison Services
15
Courthouse News Service. Ex-CIA Coder Behind WikiLeaks Vault 7 Cache Found Guilty of Espionage
16
BBC News. Former CIA Engineer Sentenced Over Vault 7 Leak
17
Press Freedom Tracker. Former CIA Agent Accused of Sending Classified Information to WikiLeaks
18
ABC News. Joshua Schulte, Largest Leaker of CIA Material in History, Sentenced
19
SecurityWeek. Cisco Patches CIA Zero-Day Affecting Hundreds of Switches
20
TechTarget. Cisco Issues Fix for Vault 7 Vulnerability Without Help From WikiLeaks
21
The Hacker News. CIA WikiLeaks Hacking
22
The New York Times. CIA Vault 7 Hacking Breach
23
ResearchGate. Vault 7 and the Future of Cyber Warfare
24
Council on Foreign Relations. WikiLeaks and the CIA: What’s Vault 7
25
Center for Democracy and Technology. Vault 7: The CIA’s Cyber Capabilities Escape From the Lab