# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# DarkSeaSkies v1.0 - Test Plan Procedures

26 January, 2009

- 1
- 2
- 3
- 4
- 5
- 6
- 7

SECRET//20340105
1 (U) Overview
(S) DarkSeaSkiesv2.0 is a tool designed for the Macbook Air that is delivered via a supply
chain intercept or a gift to the target. There are three components that make up
DarkSeaSkies. DarkSeaSkies is loaded onto the target MacBook Air via booting to a
thumb drive. The first component of DarkSeaSkies is DarkMatter which is the application
runs on the EFI of the Macbook Air. DarkMatter is responsible for loading SeaPea into
memory so that Nightskies, which is the payload, will run.
2 (U) Purpose of Document
(S) This document defines the test steps and test procedures necessary to evaluate and
establish a level of quality and operational fitness for the DarkSeaSkies tool. This
document records the results of the tests and identifies risks. If test results are satisfactory
and the risks accepted, the test process verified in this document helps assure the
successful performance of the IOC mission.
3 (U) Reference Documents
• IMIS Requirement 2009-0247 (S)
4 (U) Requirements
(S) The following requirements are pulled from IMIS Requirement 2009-0270. This is
not the full list of requirements, but only the requirements that are relevant to IV&V
testing.
Num Requirement Source Ref Note
1. Nightskies shall support the Macbook Air using
Mac OSX 10.5.x, current version.
2009-0247 1.d.ii.1
2. Nightskies shall be compatible with DarkMatter
persistence and kernel patching tool.
2009-0247 1.d.ii.2
3. DarkMatter shall have the capability to disable
itself after a configurable amount of time.
2009-0247 1.d.ii.3
4. DarkMatter shall have the capability of removing
its payload from the EFI of the Macbook Air.
2009-0247 1.d.ii.4
5. Nightskies shall be compatible with SeaPea rootkit. 2009-0247 1.d.ii.5
6. Nightskies shall support the following implant
features:
a. Beaconing to a listening post (LP).
b. Command receipt and execution from a LP.
c. File transfer to and from the LP.
d. Program file execution on the Macbook.
e. Delay after browser starts to beacon.
2009-0247 1.d.ii.6
1.d.ii.6.a
1.d.ii.6.b
1.d.ii.6.c
1.d.ii.6.d
1.d.ii.6.e
SECRET//20340105
1

- 1
- 2
- 3
- 4
- 5
- 6
- 7