# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# DarkSeaSkies v1.0 - URD

26 January, 2009

- 1
- 2
- 3
- 4
- 5

SECRET//NOFORN
communicate with the LP. If DarkSeaSkies is unable to communicate with the LP for a
configurable period of time it will delete itself from the system.
4. User Requirements
4.1 Pre-deployment Capability Requirements
Configuration details are required prior to building DarkSeaSkies. Specifically,
DarkMatter requires a caution count “Limit” and “Enable Date” as described in
DarkSeaSkies User Manual. NightSkies has separate configurations which can be found
in NightSkies User Requirements.
4.2 Deployment Capability Requirements
4.2.1 NightSkies shall support the Macbook Air with OS X 10.5.2 – 10.5.x.
4.2.2 NightSkies shall be compatible with DarkMatter.
4.2.3 DarkMatter shall have the capability to disable itself after a configurable amount
of time.
4.2.4 DarkMatter shall have the capability of removing itself and its payload from the
EFI.
4.2.5 NightSkies shall be compatible with CP rootkit.
4.2.6 NightSkies shall support the following implant features:
a. Beaconing to a listening post (LP)
b. Command receipt and execution from a LP
c. File transfer to and from the LP
d. Program file execution
e. Delay after browser starts to beacon
4.2.7 The tool shall be packaged manually, according to the parameters provided by
COG.
4.3 Post Deployment Capability Requirements
An LP will be required for NightSkies. (REF NightSkies User Requirements).
4.4 Security Requirements
None
darkmatter+darkmatter+docs+DarkSeaSkies 1.0 URD_Rev New_2009-01-26.doc
2
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5