Report discloses CIA cyberattacks against other countries

BEIJING - An investigation report was released Thursday on the Central Intelligence Agency (CIA) of the United States, one of the major intelligence agencies of the US federal government, revealing an "empire of hackers" under US manipulation.

Over a long period, the CIA has been secretly orchestrating "peaceful evolution" and "color revolutions" around the world, continuously conducting espionage activities, said the report by China's National Computer Virus Emergency Response Center and internet security company 360.

The rapid development of the internet this century has presented new opportunities for the CIA to conduct its infiltration, subversion and trouble-making activities, the report said.

The report disclosed important details of the weapons the CIA used for cyberattacks and details of specific cybersecurity cases taking place in China and other countries, and revealed the agency's harmful activities including cyberattacks and espionage. The report said it was meant to provide references and suggestions for victims of cyberattacks around the world.

The CIA has been involved in overthrowing or attempting to overthrow more than 50 legal governments of other countries, though it only admitted involvement in seven, causing turmoil in relevant countries, the report said.

It said the involvement of some Western countries with the help of the internet can be detected in multiple cases of "color revolution." After the "Arab Spring" in West Asia and North Africa, certain large multinational internet enterprises of the United States vigorously engaged in sending an abundance of personnel, material and financial resources to the conflicting sides, drawing over and supporting the opposition parties, and publicly challenging the legal governments of foreign countries that were not in the US interests. Such enterprises were also involved in assisting in the disinformation campaign and fanning the flames of protests among the public, the report said.

The report further cited several measures of such operations, including "The Onion Router (TOR)" technology that enables anonymous communication, developed by a US company with a reportedly US military background. The TOR was provided free of charge to anti-government personnel in countries such as Iran, Tunisia and Egypt to help them evade surveillance from legal governments.

Also, Google and Twitter developed a special service called "Speak2Tweet" to enable users to communicate when they are disconnected. The technology was used by anti-government forces in Tunisia and Egypt, said the report.

US company Rand developed a technology that facilitates the commanding of protests. There was also another US company developing software that enables completely independent broadband access to evade government monitoring, the report said.

In 2020, the 360 company detected an unknown attack organization, numbered APT-C-39, that was conducting cyberattacks specifically targeted at China and its international friends. The organization was found to have used weapons such as Athena, Fluxwire, Grasshopper, AfterMidnight, HIVE and ChimayRed -- all linked with the so-called Vault 7 leak -- to carry out cyberattacks targeting China and other victim countries. Relevant attacks can be traced back to as early as 2011.

The CIA massively took advantage of zero-day vulnerabilities in its global cyberattacks, setting up "zombie botnets" and "stepping stones" around the world to launch attacks on network servers, network terminals, exchangers and routers, as well as a huge amount of industrial control equipment.

The report said the 360 company obtained multiple samples of relevant cyberattack weapons, noting that most of these samples followed the development standards and technical specifications that have been referred to in Vault 7 documents. So far, only the CIA strictly observes these standards and specifications in developing attack weapons.

It also noted that the Chinese technical team obtained a sample of an information interception tool that is exclusively used by the US National Security Agency (NSA), indicating that the CIA and the NSA may jointly attack the same target, share attack weapons with each other, or provide technological or personnel assistance to each other.

The cyberspace hegemony under US manipulation is shadowing the entire world, with the CIA launching automated, systematic and intelligent attacks worldwide, the report said.

After analyzing relevant cases, the technical team found that the reach of such attack weapons has covered almost all internet and Internet of Things assets, making a foreign country's network and important and sensitive information susceptible to US control or espionage, the report said, adding that the United States is a genuine "empire of hackers."