CASE DOSSIER
sentenced
U.S. v. Joshua Schulte (CIA Vault 7 Leak)
Docket: 1:17-cr-00548 Court: U.S. District Court for the Southern District of New York Opened: 2017-08-24 Sector: Intelligence, National Defense, Federal Government
Key Facts
Status
SENTENCED
Legal disposition
Loss Amount
$500.0 million
Government loss estimated in hundreds of millions in operational capability destruction across global intelligence activities.
Techniques
3
Verified mappings
Defendants
1
Named in charges
- Legal Status: SENTENCED in U.S. District Court for the Southern District of New York.
- Primary Target Sector: Intelligence, National Defense, Federal Government.
- Documented Financial Loss: $500.0 million.
- 3 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Export structured case data and MITRE ATT&CK Navigator layer:
Case Summary
Former Central Intelligence Agency software developer convicted of the historic transmission of classified CIA cyber warfare tools, source code, and zero-day exploits (Vault 7) to WikiLeaks, causing catastrophic national security damage.
Procedural & Incident Timeline
2018-06-18 indictment
Grand jury indicts Schulte for illegal transmission of national defense information and computer hacking under the Espionage Act.
2022-07-13 verdict
Jury convicts Schulte on all counts of espionage, computer hacking, and obstruction of justice.
2024-02-01 sentencing
Sentenced to 480 months (40 years) in federal prison.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Joshua Adam Schulte | United States | sentenced | 480 mo | None | Former CIA engineer who leaked Vault 7 cyber tools to WikiLeaks. Sentenced to 40 years in federal prison. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1078 | Valid Accounts Defense Evasion | "Schulte abused his administrative credentials as a CIA Center for Cyber Intelligence software engineer to grant himself backdoor access to secure development servers." | Indictment ¶ 14, Page 8 | reviewed |
| T1070 | Indicator Removal Defense Evasion | "Defendant deleted server log files and altered system configuration timestamps to conceal his exfiltration of the CIA development branch." | Indictment ¶ 18, Page 11 | reviewed |
| T1560.001 | Archive via Utility Collection | "He compressed the entire CCI codebase into encrypted archives before transferring the files offsite." | Trial Transcript Day 8 | reviewed |
Cite & Embed This Case Record
Public Domain / CC0 Bluebook Legal Citation:
Cyberattack Case Library, U.S. v. Joshua Schulte (CIA Vault 7 Leak), No. 1:17-cr-00548 (U.S. District Court for the Southern District of New York 2017), https://cyberattackcaselibrary.pages.dev/cases/us-v-schulte-cia-vault-7/
Embeddable Incident Card (HTML):
<iframe src="https://cyberattackcaselibrary.pages.dev/embed/case/us-v-schulte-cia-vault-7" width="100%" height="220" style="border:none; border-radius:6px;" loading="lazy"></iframe>