Revealing the RATs and scoring the agencies

FBI flash alert could reveal RATs behind OPM breach

The full text of a June 5 FBI flash alert, which appears to be linked to the recent breaches at the Office of Personnel Management, was posted online by the Public Intelligence blog late on June 27.

The alert warned private industry of hackers accessing systems through stolen credentials and hijacking Domain Name System (DNS) queries, then deploying custom Remote Access Tools (RATs), including:

• Sakula, a RAT that has the capabilities to launch remote command shells, enumerate processes, download files, and beacon to Command and Control (C2) domains. Sakula attempts to send a two-beacon set over TCP port 80 to a configured domain. If the domain is unavailable, it will attempt to connect to a secondary domain over TCP port 80 and 443 using HTTP.
• FF RAT, a RAT that has the capabilities to download Trojan DLL files to memory and beacon back to C2 domains and was named based on the unique string "FF-RAT USER" found within the malware. The data sent in the beacon is XOR-encoded using the key 0x27.
• Trojan.IsSpace, a RAT that contains multiple files that include a dropper (EWSNH.exe), Trojan (AOFVPMJXVT.exe), privilege escalation tool (SensrSvc2013.exe), and a module used by the tool (SensrSvc2013.dll). This malware is capable of bypassing dyndns categorization by using a proxy through Google AppProxy's hosted on appspot domains.
• Trojan.BLT, a RAT that is executed from its export CreateInstance, the mutex HFRM_ is created and a process instance of cmd.exe is launched to execute the command "ipconfig/all" to collect the victim system's MAC address. Trojan.BLT will test network connectivity by establishing a connection with a legitimate website. This malware is capable of bypassing dyndns categorization by using a proxy through Google AppProxy's hosted on appspot domains.

The alert does not name OPM, but merely notes hackers have been taking personal information from systems. Public Information's post appears to be the first full public posting of the alert, which was sent the day after the OPM breach was publicized.

The Washington Free Beacon explicitly connected the alert to the OPM breach and pinned the blame on China, noting Sakula "requires cyber sophistication that is not known to be used outside of nation-state cyber forces." That is a connection lawmakers have echoed.

The FBI declined to publicly confirm the authenticity of the alert.

SBA hands out good grades for small business contracting

Seventeen of 24 agencies got "A" grades in the Small Business Administration's report on agencies' 2014 contracting awards to small businesses, but only three -- the U.S. Agency for International Development, the Commerce Department and the Department of Homeland Security -- earned an "A+."

According to the SBA's June 26 report, buyers met or exceeded the federal goal of 23 percent of contract dollars to small businesses in fiscal 2014.

The SBA said that in fiscal 2014, 24.99 percent, or $91.7 billion, of federal contracts were awarded to small business contractors.

The General Services Administration got an "A" in the Small Business Administration's report on agencies' 2014 contracting awards to small businesses.

GSA, which awarded $1.5 billion to small business in fiscal 2014, was one of those earning an "A."

Jerome Fletcher, associate administrator in the agency's Office of Small Business Utilization, said in a June 29 blog post that GSA developed and implemented a dashboard to track ongoing subcontracting performance and target goals across the agency in 2014. The dashboard helped the agency exceed its 2014 small business subcontracting goal by 25 percent, he wrote.