International Cyber Terrorism

of the cyber-collection agent in order to ensure that detection in one location will
not compromise others.
• Bypass Encryption: Because the malware agent operates on the target system
with all the access and rights of the user account of the target or system
administrator, encryption is bypassed. For example, interception of audio using
the microphone and audio output devices enables the malware to capture to both
sides of an encrypted Skype call.
• Exfiltration: Cyber-collection agents usually exfiltrate the captured data in a
discrete manner, often waiting for high web traffic and disguising the
transmission as secure web browsing. USB flash drives have been used to
exfiltrate information from air gap protected systems. Exfiltration systems often
involve the use of reverse proxy systems that anonymize the receiver of the data.
• Replicate: Agents may replicate themselves onto other media or systems, for
example an agent may infect files on a writable network share or install
themselves onto USB drives in order to infect computers protected by an air
gap or otherwise not on the same network.
• Manipulate Files and File Maintenance: Malware can be used to erase traces of
itself from log files. It can also download and install modules or updates as well
as data files. This function may also be used to place "evidence" on the target
Page 69 of 174