Rain Maker

In the flames of recent reports, we at RDN direct your attention towards "Rain Maker". Opperation Rain Maker, is a CIA run program that uses certain private technology to gather data. We bring this to our attention due to the process involved. We give you the exact information regarding the process below.

S) Rain Maker v1.0 is a collection tool intended to be run from removable media. Version 1.0 specifically is designed for use with portable VLC Player (2.1.5). To trigger collection, the user must open up VLC player on the target machine from the removable media. The removable media can appear as either a fixed or removable drive but must be formatted NTFS. Upon opening VLC player, Rain Maker collects a standard survey of the machine (RoadRunner Survey) and a prioritized file collection. A survey will only be taken on any machine if the last survey of the machine is seven days old or older. The collected data is stored back to Alternate Data Streams off of the root of the volume. For example, if the removable media appears as volume E:\, the data is stored in E:\:$DataIdN. Configuration options allow the user to specify a prioritized list of directories from which to collect files (environment variables can be used), a list of extensions to collect, the percentage of drive space to be left free, and the drive to configure/tie the tool to. Upon configuring a piece of removable media, a public/private key pair is generated (the private key in generated in Implant\Deploy as well as in PostProcessor). The private key must/must be kept in order to decrypt the returned data. A user may also specify a public key if a specific key pair is desired. Also, upon configuring a drive, a "stub" is generated that ties the tool to the drive. The stub, once loaded, decrypts Rain Maker and executes it. This means that if the drive is reformatted or if the portable player is moved to another drive, the actual collection tool will not be decrypted and as a result Rain Maker will not run.

What does this all mean? it means there are ways to get information form your computer on a scheduled basis, depending on how often you op certain software. We use the word software, because it is not too crazy to believe that they are not only using VLC to get this information. It is created as a voluntary file, letting you get this information from your own machine, We just don't believe that is where it stops.

With the previous report, we delved into the capability of access, so we can safely assume this could be done remotely.