by Adam Carter, Disobedient Media:

Recently, Ray McGovern (former CIA analyst & Veteran Intelligence Professionals for Sanity co-founder) appeared at the Left Forum, where he stated that the CIA’s Directorate of Digital Innovation (DDI) might be behind the alleged “hacking” of the DNC based on circumstantial evidence arising from the release of Vault 7.

This article highlights the most relevant parts of Vault 7 that could be used for mimicry and masquerading, evaluating the viability of the thesis that Vault 7 could have been used by Guccifer 2.0, and for the production of malware discovered within the DNC network which would later found to be anomalous.

The Argument For The CIA Being Behind The DNC “Hack”

Vault 7, the CIA’s cyber warfare arsenal exposed through leaks throughout 2017 contained tools, some of whichallowed the CIA to obfuscate code in such a way they could make it appear as if their malware had been produced by a foreign country.

Analysis performed by this writer and the Forensicator has repeatedly indicated that the Guccifer 2.0 operation was phony and mimicked Russian fingerprints, with recent evidence suggesting it was a complex, comprehensive and multi-layered fabrication that extended far beyond the basic document metadata.

Therefore, as argued by McGovern, those responsible for allegedly breaching the DNC network and leaving other types of fingerprints (eg. in relation to malware discoveries, etc) were more likely to have been associated with CIA’s Directorate of Digital Innovation than the Kremlin.

On the basis outlined above in isolation, it certainly seems like a plausible connection that would explain why some of the “RussiaGate” evidence was so flaky and in some cases, deliberately, if clumsily, manipulated to implicate Russia.

However, looking at Vault 7’s tools and what has been discovered regarding malware found at the DNC  we are given reason to doubt there was any use of the Vault 7 arsenal, at least, in relation to both the malware and the fake hacker persona.

How Relevant Is Vault 7 To Guccifer 2.0?

While McGovern’s point was more to do with the malware than anything else, there have been quite a few people (on social media, etc) who have suggested that Vault 7 could explain some of the fabrications we saw in relation to Guccifer 2.0, so, for sake of confirming (or refuting) the premise we’ll look at this first anyway.

There are two Vault 7 tools that would aid in mimicry.

One of these was named “Umbrage,” a project to build a library of third-party malware components that, incidentally, could be employed to misattribute to the original authors of malware when deployed.

The other was named “Marble,” a tool used for manipulating malware code to obfuscate text by replacing strings with foreign language equivalents and alternates. Again, this capability would allow the CIA to mask the origin of malware by using other languages within the code itself.

While both of these Vault 7 tools were useful for constructing malware, Guccifer 2.0 didn’t actually produce any malware. All of his mimicry was carried out through other techniques including modifying documents to leave misleading timestamps, metadata and error messages.

In light of this, for the purpose of attributing Guccifer 2.0 to anyone, Vault 7 is irrelevant because the tools themselves and the products they help produce do not technically match up with what Guccifer 2.0 had produced.

Due to the fact that Guccifer 2.0 used different types of mimicry when compared with those that Vault 7 caters for, we’re left with the only aspect of the DNC “hacking” narrative that Vault 7 could have potentially been used for – the controversial malware discovered within the DNC network).

How Relevant Is Vault 7 To The Malware Discovered?

The primary anomaly spotted in the malware which indicates a potential deception attempt was the presence of a C2 (or “Command & Control”) server IP address attributed to Fancy Bear.

Some information security experts, including Matthew Tait and Thomas Rid, hailed this as proof that Fancy Bear must have been used in alleged Russian-backed attacks on the DNC.

However, it’s now apparent that they hadn’t considered (and seem to remain stubbornly obtuse to the fact) that the IP address in question had ceased to be under Fancy Bear’s control for over a year prior to the date the malware was compiled, and so it would have been of little practical use to those behind Fancy Bear. The only thing it was really good for was making it possible to claim the DNC was being targeted by that group.

The Vault 7 tools that could be relevant to mimicry deceptions, as mention above, are “Umbrage” and “Marble.”

While Marble does obfuscate text strings and data through a component called “Mibster,” it appears it isn’t intended for specifically framing a target (link to framework PDF):

The placement of the IP address wouldn’t require a tool like Marble, and the fact the type of malware and IP address match up with what Fancy Bear have used in the past suggests either a more manual, targeted approach or the far simpler alternative of malware being compiled based on code acquired from disassembling old Fancy Bear malware in the past.

The Umbrage project does look like a better contender to explain the malware, especially with the way it is described in a brief summary WikiLeaks provided:

However, when you dig a little deeper, you will find that Umbrage isolates techniques into components:

So, while Umbrage is a library of malware components, these are individual functions and were used in the CIA’s own malware projects.

If Umbrage components were used to build something, it wouldn’t have come out appearing like the full X-Agent package (like the malware discovered did) and would have just incorporated some of the techniques used by the APT group.

Conclusion

Vault 7’s tools, when fully considered, do not correlate with any of the observations made that suggest mimicry efforts in relation to Guccifer 2.0.

Read More @ DisobedientMedia.com