Named attack · kill-chain walkthrough
OPM Breach
21.5 million cleared-personnel records to Chinese intelligence
Deep Panda (China MSS-affiliated)May 2014 – April 2015 (discovered April 15, 2015)Moderate confidence
Attributed by U.S. officials to Chinese government-affiliated hackers; open-source reporting points to the Jiangsu State Security Department, a component of China's Ministry of State Security (MSS). CrowdStrike publicly links the Sakula RAT used in related intrusions to Deep Panda (G0009). No public DOJ indictment names this intrusion. Director of National Intelligence James Clapper acknowledged Chinese capabilities in obtaining the data.
In two overlapping intrusions spanning nearly a year, China MSS-affiliated actors compromised the U.S. Office of Personnel Management and exfiltrated the most sensitive personnel database in the U.S. government. Using credentials stolen from a KeyPoint Government Solutions contractor, attackers installed PlugX and Sakula RATs, located the background-investigation repository, and exfiltrated approximately 21.5 million SF-86 security-clearance forms — including 5.6 million sets of fingerprints — along with 4.2 million federal employee personnel records. The SF-86 files contained decades of intimate personal data on cleared personnel and their families, giving Chinese intelligence a near-complete map of the U.S. national-security workforce.
scene 00 / 07
- Phase 01 · Initial AccessTA0001
Stolen KeyPoint contractor credentials open OPM's perimeter without an exploit
- Attackers posed as a KeyPoint Government Solutions employee using that contractor's legitimate OPM-issued credentials — no vulnerability exploitation was required to cross the network perimeter.
- KeyPoint had itself been breached in late 2014, exposing credentials for tens of thousands of federal workers. USIS, KeyPoint's predecessor as OPM's background-investigation contractor, was separately breached in August 2014 via an SAP vulnerability.
- OPM had not enforced multi-factor authentication on remote access; single-factor credential reuse went undetected because the logins appeared legitimate.
- A first, smaller intrusion ('X1') was detected on March 20, 2014 after a third party notified DHS. A second, more damaging intrusion ('X2') began May 7, 2014 via contractor credentials and was not discovered until April 15, 2015.
- Phase 02 · Execution & PersistenceTA0002
PlugX and Sakula RATs installed, registry run keys and Windows services anchor the foothold
- After logging in via stolen credentials, attackers installed PlugX — a modular remote-access tool widely associated with Chinese APT operations — to establish a persistent, remotely controllable foothold inside OPM systems.
- Sakula RAT (also known as Sakurel / VIPER), publicly linked to Deep Panda by CrowdStrike, was also deployed. Sakula communicates over HTTP using single-byte XOR-encoded traffic, making it resemble ordinary web traffic.
- Sakula achieves persistence via Windows Registry Run keys and as an installed Windows service. DLL side-loading using signed antivirus binaries (Kaspersky or McAfee) was used to masquerade the malicious DLL as a trusted process.
- Keystroke-logging capability was confirmed on database administrator workstations, enabling credential harvesting from privileged OPM accounts.
Techniques - Phase 03 · Command & ControlTA0011
Attacker-registered domains blending into government-adjacent names beacon out over HTTPS for nearly a year
- opmlearning.org was registered July 29, 2014, mimicking an OPM training or learning portal. It served as a primary C2 node for malware operating inside OPM's network.
- wdc-news-post.com was registered March 3, 2015, mimicking a Washington DC news outlet. It replaced or supplemented earlier C2 infrastructure as the operation matured.
- Sakula's C2 traffic is encoded with single-byte XOR and transmitted over HTTP, blending with normal web traffic; PlugX supports HTTP, HTTPS, and raw TCP/UDP depending on configuration.
- The operation ran undetected for roughly eleven months (May 2014 – April 2015), indicating the C2 traffic was not flagged by OPM's monitoring tools — OPM lacked network-level traffic inspection capability at the time.
TechniquesIndicators - Phase 04 · Credential Access & DiscoveryTA0006
Keyloggers on DBA workstations harvest privileged credentials; attackers map the clearance database
- Keystroke-logging malware was confirmed installed on database administrator workstations, directly capturing the credentials used to access OPM's most sensitive databases.
- With DBA-level credentials, attackers could enumerate the network and locate the e-QIP system (Electronic Questionnaires for Investigations Processing), which held SF-86 background-investigation records.
- OPM's November 2014 Inspector General report had already flagged the lack of a comprehensive server/database inventory and absence of multi-factor authentication — weaknesses attackers exploited months before the report was published.
- Attackers performed file and directory enumeration to identify where personnel records and background-investigation files were stored before staging data for exfiltration.
Techniques - Phase 05 · CollectionTA0009
SF-86 forms, fingerprints, and personnel files staged for exfiltration over months
- Background-investigation (SF-86) records were exfiltrated during July–August 2014, covering approximately 21.5 million individuals — including current, former, and prospective federal employees and contractors who had applied for security clearances, plus their spouses and cohabitants.
- SF-86 forms are 127-page questionnaires capturing decades of personal history: financial records, drug use, mental health consultations, foreign contacts, family members, past addresses, and neighbors who were interviewed.
- Approximately 4.2 million personnel records — covering employment history, salaries, and performance ratings for current and former federal employees — were exfiltrated in December 2014.
- 5.6 million sets of fingerprints were exfiltrated beginning March 26, 2015; their intelligence value was assessed as particularly long-lived since fingerprints cannot be changed.
Techniques - Phase 06 · ExfiltrationTA0010
21.5 million SF-86 records and 5.6 million fingerprints leave over HTTPS — undetected for nearly a year
- Data was exfiltrated over the established PlugX/Sakula C2 channels using HTTPS, making the traffic difficult to distinguish from legitimate encrypted web traffic without deep packet inspection.
- The exfiltration spanned at least three distinct periods: background files (July–August 2014), personnel records (December 2014), and fingerprint data (beginning March 26, 2015).
- OPM lacked the network monitoring tools to detect large-volume data egress; the November 2014 IG report explicitly noted the absence of real-time monitoring and a complete server inventory.
- The operation continued undetected until April 15, 2015, when OPM staff deploying a new Cylance endpoint product noticed indicators of compromise — not the Einstein intrusion-detection system.
Techniques - Phase 07 · Discovery & DisclosureTA0040
Cylance demo catches the breach on April 15; public disclosure June 4 triggers congressional fury
- On April 15, 2015, OPM personnel running a Cylance endpoint security product during an evaluation discovered indicators of compromise — ending an intrusion that had persisted for approximately eleven months.
- OPM publicly announced the breach on June 4, 2015. Director Katherine Archuleta resigned July 10, 2015; CIO Donna Seymour resigned February 22, 2016 — on the day she was scheduled to testify before Congress.
- FBI Director James Comey called the breach 'a very big deal from a national security perspective,' describing OPM's data as 'a treasure trove of information about everybody who has worked for, tried to work for, or works for the United States government.'
- DNI James Clapper acknowledged Chinese capabilities in obtaining the data, stopping short of formal public attribution. U.S. officials privately and then publicly described the perpetrators as Chinese government-affiliated.
- The House Committee on Oversight and Government Reform published its majority staff report 'The OPM Data Breach: How the Government Jeopardized Our National Security for More Than a Generation' on September 7, 2016, excoriating OPM leadership for ignoring years of Inspector General warnings.
- No public DOJ indictments have named the OPM intrusion specifically; by 2017, Chinese national Yu Pingan was arrested for separately providing the Sakula malware to hackers, though not charged directly for OPM.
Techniques
Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
Adversary
- Deep Panda (China MSS-affiliated)
Capability
- T1078
- T1078.003
- T1059.003
- T1547.001
- T1543.003
- +1 more
Infrastructure
- opmlearning.org
- wdc-news-post.com
Victim
- See narrative above
Primary sources
- 2015 Office of Personnel Management Data Breach · Wikipedia (citing OPM, House Oversight Committee, FBI, ODNI)
- Congressional Report Slams OPM on Data Breach · Krebs on Security · 2016-09-07
- Catching Up on the OPM Breach · Krebs on Security · 2015-06-15
- G0009 — Deep Panda · MITRE ATT&CK
- S0074 — Sakula · MITRE ATT&CK
- S0013 — PlugX · MITRE ATT&CK