Greetings, Special Agent K.

Our Incident Response team has flagged a persistent intrusion within a strategic infrastructure network.

The Tactics, Techniques, and Procedures (TTPs) observed strongly align with North Korean threat groups. The attackers successfully established persistence by deploying a specific backdoor (a specialized C++ implant).

We have identified a Command & Control (C2) server and recovered a partial file hash from the infected workstation. We need you to bridge the gaps in our intelligence.

Evidence Logs

• C2 IP Address: 23[.]27[.]124[.]228
• Partial Malware Hash (SHA-256): 15208030eda48b3786f7d85d756d2bd[...]

To complete the report, you must complete the following tasks:

• The Full Signature: Pivot from the partial fragment to find the complete file signature.
• The Delivery Mechanism: Identify the specific malware name used by Lazarus the attacker
• The Connection: Identify the exclusive tool associated with this specific campaign's infrastructure.

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: FullHash-RansomwareName-ToolTheyCreated
Answer example: 8f2e9a3b7c1d5f4e6a0b2d8c4f9e1a3d5b7c0d2e4f6a8b0c2d4e6f8a0b2c4d6e-Locky-HotCroissant

Greetings, Special Agent K.

The client has identified a massive compromise across their IIS server farm. The malicious activity is characterized by abnormal CPU spikes dedicated to cryptocurrency mining. While the firewall failed to block the outbound traffic, the detection system (SIEM/EDR) triggered a critical alert based on a suspicious sequence of Windows events.

The attack follows a logical progression of Access Token Manipulation to achieve elevation of privileges:

• Event ID 4624 : A successful logon session was created. The attacker leveraged a web service account previously compromised through a web application vulnerability.
• Event ID 4688 : This is where the elevation occurs. The attacker executed an impersonation tool (obfuscated as let.exe) to transition from "Service" status to NT AUTHORITY\SYSTEM. Command used : "C:\programdata\let.exe -t t -p c:\programdata\rn.bat -l 1234 -c {8BC3F05E-D86B-11D0-A075-00C04FB68820}"

We are concerned this breach goes deeper than simple mining. We urgently need to attribute this activity to a specific threat actor and pinpoint the exact mechanism they exploited to escalate their privileges.

To validate your incident report, you must provide the following:

1. The unique Group ID on the MITRE ATT&CK framework.
2. The technical name of the Windows Privilege abused to achieve this escalation.

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: MitreGroupID-PrivilegeUsed
Answer example: G0206-SeDebugPrivilege

Greetings, Special Agent K.

The client has suffered a catastrophic ransomware attack. At 03:00 AM, the entire infrastructure went offline. Every single file on the production and backup servers has been encrypted. No ransom note was immediately found in the clutter, but the EDR (Endpoint Detection and Response) managed to capture a hash of the main encryption binary before being terminated.

Our initial triage recovered a single high-priority Indicator of Compromise (IoC) from the local buffer logs:

02b49fd8781580e1f25034c9ca89d7989729f6ca898579f434cc6122247b7c06

The Board of Directors is panicking. They need to know exactly who they are dealing with and the scale of this group's recent success to decide on the negotiation strategy.

Your mission is to identify:

1. The official name of the ransomware group associated with this hash.
2. The estimated total revenue this specific group accumulated by late September 2025 (please round to the nearest million).

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: groupname-amount
Answer example: lockbit-120

Greetings, Special Agent.

We've just received word from our friends at Interpol. Specifically their "Maritime Piracy and Illicit Trafficking Unit". They raised concerns about a vessel using a name that doesn't match its AIS signal. Furthermore, this freighter is suspected to be smuggling narcotics from Latin America to Europe.

We know this vessel left its port of call 10 days ago, on Feb 11, 2026, 15:44 UTC.

The name painted on its hull is Magic Nova, which doesn't match the AIS signal.

Bulk Carrier, IMO 9425679

Identify the true name of the vessel, the flag it flies, and its port of destination.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer Format: ship-name-port-of-call-destination-city
Answer Example: sea-bird-united-kingdom-antwerp

Greetings, Special Agent K.

We have a special case on our hands today. As tensions around the island nation of Taiwan rise by the day, allied nations reach out frequently for our help. Today is no exception. This morning at 09:43 Taipei Standard Time, the Taiwanese Navy identified a foreign vessel entering it’s waters.

Upon making contact, the ship left westward for international waters. However, a UAV was dispatched and managed to snatch a picture of the vessel.

The ship did not identify, nor does it match the database of known vessels operated by any Navy around the world. It comes close to several, but appears to be altered for a different purpose. The Taiwanese government signed a contract for our services to identify the original make and model of the vessel.

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: type-123q-nato-reporting-name
Answer example: type-555d-kingkong-IV

Greetings, Special Agent K.

Perhaps you remember our old friend Maksim Kotova? After his capture in Panama he was more than willing to cooperate for reduced sentences.

Following up on the leads he’s given us until this point has resulted in the arrest of several high ranking officials and members of various underground organizations. One of his more promising leads is a military parts smuggling operation organized by one of Maksim’s former Cold War friends, Vasili Semenov.

Semenov is quietly making a fortune selling Russian military spare parts for scraps to the highest bidder. A lot of these parts aren’t even spares in the literal sense of the word. These parts are all brought together through various air bases around Russia and the world, then routed to a central air base. Where they’re exchanged for cash.

Given the current sticky situation around Russian activity. Not to mention the limited jurisdiction of our client. You are tasked with finding the air base where these sales take place. The old man wasn’t very much into modern technology, so all we have for you is a satellite image of the air base. Other items found, are sent to a forensics lab by our client.

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: country-governate-district-airbasename-air-base

Greetings, Special Agent K.

Yesterday evening around 2100 hours, two NYPD officers entered an abandoned building in Brownsville following neighbor complaints about a squatting woman and strange noises.

What drew NYPD's attention was security footage showing multiple people entering the building but never leaving, despite all windows being sealed and only one entrance under surveillance.

During their search, officers spotted someone at the end of a hallway who retreated behind a door. When they approached, they briefly saw a woman move past the doorframe. Despite commands, she disappeared completely.

A subsequent sweep by twelve officers and a K-9 unit found no one - not even a scent trail.

Most concerning, the body cam footage is missing audio entirely. We need you to analyze this video and determine what happened.

As always, Special Agent K, the contract is yours, if you choose to accept.

Download the bodycam footage

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: a long string of different characters
Answer example: j32cnrmCURvu2kt

Greetings, Special Agent K.

We have an urgent and very grim scenario on our hands. About 20 minutes ago, we received word from one of our red teams, that they’ve uncovered plans on the dark-web to test a new neuro-toxic gas on an undisclosed city.

Dimitri was able to pull metadata and an image from a forum this group is active on.

The image reveals a city, which is believed to be the testing ground for the dirty bomb. We still do not have a time-frame for the attack, all we know is that the amount of gas will cost hundreds of people their lives. Not to mention the suffering ending caused by the gas itself.

Our priorities are to find out more about the group, this is done in collaboration with EUROPOL, hence our main task is finding the location of the city. We hope the realization that the location of their plans has leaked, will cause some of the members to make a bad move.

Your task is to locate the city in the image below.

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: country-city
Answer example: chile-santiago

Greetings, Special Agent K.

You’re probably wondering why we’re currently flying over Jalisco, one of Mexico’s western states. Instead of continuing towards Honolulu for our team Christmas party. We’re looking for our team member, Isabella Moreno. She was presumably kidnapped while visiting family in the small fishing village of Boca de Tomatlan. Or “Boca” for short.

After our latest operation, “Barracuda”, she decided to fly from Colombia to Mexico, to visit family and have Shadow Wing pick her up at Puerto Vallarta International. On our way west towards Honolulu.

Her aunt reported her missing to the authorities last Saturday, after she failed to come home from a night out with friends. Since it’s a small town, she spent most of the day asking around with the locals. Nobody had seen Isabella after she left her friend's place at 3 AM.

As I’m listed as the emergency contact for everyone within HACKTORIA, local authorities informed me after receiving my contact details from her mother. I’ve ordered our plane to start a circular search of the Jalisco province, starting at the town of Boca.

As we haven’t picked up any distress signal from her subdermal emergency beacon. The device either failed, had the signal blocked or was cut out of her body by her captors. Neither scenario is good. Since the kidnappers haven’t contacted anyone for ransom, and given that Isabella is a young and attractive local to Mexico. She’ll most likely be trafficked and sold into modern day slavery.

Dimitri has directed our entire electronic warfare suite to monitor for any signals coming from below. This is where you come in. We’re getting our first potential signals filtered through. It’s your task to make sense of the information and figure out if it’s her distress signal. And if it is, where she is being held.

Her distress call sign is: “mor31”. This will most likely be present in her distress call.

The field ops team is prepped and ready to go. Once we find her location, we’ll make a plan for extraction and help the Mexican authorities neutralize some kidnappers while we’re at it. Their mandate is code zero. Meaning we take no prisoners in return.

As always, Special Agent K, the contract is yours, if you choose to accept.

Download the morse code message

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: what3word location in English
Answer example: word.word.word

Greetings, Special Agent K.

Our friends over at the South Africa National Defense Force have reached out for help. Recently, one of their patrols in the north of their country, came under fire from an armored vehicle.

At first they thought this to be friendly fire, however no other units were in the area.

They sent a drone to inspect the vehicle and managed to take a photo, before being forced to retreat. Six out of the twenty-four strong platoon were injured, all survived after being evacuated by helicopter.

As they are unfamiliar with the model of the tank, which has since vanished. Therefor they call for our help in identifying the vehicle.

That is where you come in, identify the tank so we can track the origins and maybe get further in this investigation.

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: model and country of origin of the tank
Answer example: model and country of origin of the tank

Greetings, Special Agent K.

We have received information regarding the long lost spy from MI5, Deloris Frozenwood. She went missing in action a few years ago, never to be seen again. From what we understand, she went on to provide services to whoever the highest bidder might be.

Before she went rogue, Deloris was a revered operative within MI5. Taking on some of the most dangerous assignments and quickly working her way through the ranks. Discontent with management, she took matters into her own hands. Often skirting the lines between rule of law and criminal behavior. She was eventually terminated from MI5.

What happened after her career at MI5 remains shrouded in mystery. She showed up on the radar several times, but only for very brief moments. Having become a target of the organization she once worked for, she’s even gotten arrogant. Often making deliberate appearances for a brief moment, before vanishing to the shadows once again. Our colleagues at MI5 have asked us to obtain any information on Deloris Frozenwood we can find. They’re particularly interested in social media profiles. For reference, Deloris often appears as “Deloris Frozenwood”, or as “D Frozenwood”.

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: a long code, you'll know when you see it
Answer example: JFJjc2jr9rfmlj4t3t

Greetings, Special Agent K.

Two days ago, during a routine escort of a Malian VIP, the convoy was ambushed by unknown insurgent forces. The VIP and most of the convoy managed to return fire and make it out alive. One of the soldiers however, Raphaël Bernard, was hit in the right leg and taken prisoner by the insurgents. Not being able to reach private Bernard before being captured, French forces were ordered to stand down and not give chase.

Continuing efforts of the French government to locate the missing private have yielded no results. Up until this morning, when a young girl approached a local police unit. She conveyed to them she had escaped a childrens home where she was kept against her will. The man who helped her escape, gave her a picture of the place they were being held. We have reason to believe this man is the missing private, Raphaël Bernard.

The girl approached the officers on the RN1 near “Posté de contrôle KAYES”. Below you find the image given to the girl, as well as the AOR (Area of Operation) of the remaining French detachement. It’s your job to locate the building where the French private is being held. Once the location is confirmed, French special forces will conduct a raid to extract Raphaël Bernard.

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: Full name of the location, as listed on Google Maps.
Answer example: habitat-d-azure-hotel-champagne

Greetings, Special Agent K.

We have an urgent matter on our hands. For several months we’ve been investigating a group called “Androktasiai”. A radical organization who believes in cleansing the planet of what they call gluttony. Believing firmly that humans are a disease that needs to be exterminated, this radical group is well organized and is preparing to strike several targets.

After breaching one of their email accounts, we were able to extract a sent item. The metadata didn’t prove to be of much help, as it was sent to a disposable 10minutemail address. The contents however are of great interesting.

We believe it contains instructions sent from one of the groups’ leaders to a sleeper cell. This sleeper cell will now be activated and preparing to carry out an attack somewhere. It is your task to figure out what the text means and provide any intelligence about the plans of this organization.

As always, Special Agent K, the contract is yours, if you choose to accept.

Encoded Text

SSB1cmdzIG9rZSBscGlhIHR2cHYgbXluIGhzZGUgaWxlaHJyaSB5b212ZCB3dWcgZXAgaHJ4IHdnemRhIGF5dXZvbnIgc2h3a21uICh2aSBwY2UgdHJ3IHZvYiBtYnZrIHJlZWwsIGFvbndybnFrLCBveHcgZmd3bHFzdSkgd3lzIG14cmxpaXYgbW53a3NiIGhmIGxwZSB0ZW51ZXNuIEloYXRvYW9ja3ZmYyB1bHdhc21kIGZ3ZmJvLCBwaHd6ZXduIE5vdHZvZnkgb3dyc3MsIGprenpvIHBlIHd2ZG1haXJpIGh5IGllam5la3QgZ2t2IHd3aWVqbmVrdCwgbnF1IGhydHQgb3F0cCB0dWxldWMgZm9qbSB0cGVhIHN2ZnB4Y2wuIElubCBmYnUga3ZrbSBuc2J1emUgdWRqIHJvZWlubXJtZCBodiBrdm8gYm1obXJuZXB3IGZidnIgd2FiaCBiaHIgc3ZmcHhjbCwgcXQgcXMgYnhpIGRra3QgbHcgbWlrciB3eXMgd3R0bG1yIChxbiBna3YgdHlrbXd6IENwYWN3dmZjIHdldXRhemVxIHhlaHkgbnMpIGV3cm0gdHVoZSBkb2tmd2t0IGp5IGJ4aSBvYm1peHFjcWF5IG9ycHlrLiBBZmwgaW4gd3IgbmVjZyBnb2wgYmhtIG1ucWVzYiBoZiBvd3JzaWFqLCBudmttIGlrIGJobSBjbnhqcyBkYWFsIGVlIGxvIGFyayBnb3ggaGdlIG5pdGh1diAoa3JiY3ogd2YgdG9haiBrd3d4IGhzYSBwbXJzaHRob3cgbXdiYXRzKSBxcnZnIG1obmxxbmNheW9wIGt5a2shIFZ3IHdtIG5idyBqc28sIG1oc2IgaXYgdHVoIER3eHhzIGxwcnd1dGsga3ZvIHZvZmJpdnVubyB5c2ttIHR6aXQgcXMgdnEga3ZvIGZvbXZ0aWlhdiBrdm9rZWduLCB0cGUgdHVmZ2NnZWthIG9uIHdud3ZmIHNsIHNnIGxla29wd3ZyIGtnZCBscGlra3JxdnIsIGRhYWwgcW4ga29hd3piZXRudW0gb24gdHZwdiB3ZCB1ZXV3bW1zIE51eHN4bS12YWRlPyBJbnEgd3lvZCBoZiBscGUgbmFncXZnYyBoZiBscGUgbWFld3kgaHJrb21vaCBiaHIgdnJhbyBhZXNiIGF2ZCBxaHRjbW1pZ3YsIFNjbGNrbGYgc2wgZWZvZXZkcnV2ciEgS2dkIGxwYWIgdHV1ZmlxYSB0em0gc2ltciBrdm9kIHBpbHBvY3QgdnFrc2JmaWthaXduIHByZWhzZ3V3bCBpdiB0dWhkLCBvdmUgbXdiYXRzIG51diBzeHplZmxlemVxIHJ3IGhyeG0gc2tjd3JxbGV1IGRoIHR6bWl6IHBodXpoaSB0bnYgcW14dWVsa20/IGtnZCBscGFiIG5ud2xmbyB3b3dhIGJnIGRyZmZxZGJvZiBpbHduciBzdmZweGNsIHdyIHVheGggcnp2IGZlbGlsYSwgYWYgenZ6diBpZWpuZWt0IG52IHphenhyeG1jYj8gMCBla3dpc3d4IG1zbG5tc2YhIHp5b2QsIEIgcGppeSBnb2gsIGZmYmNtcnNxbmEgeWJ4IGtjIGN4ZWMgYm8geGVlaXZxZCBtaHcgbm96ZWZkenIgZGFpZm9zIGp5IGZ3aW94emUgZW1saW5wa2Z6c3ZhZCBpbmwgZm5xa29jbWl1aWwgemV0bGRzeG1zISBzYSBvdmUgZmRwZzogR2hlIGx3IHl3dSBna3JoIGdibGQgd3ZtcnByZHMgeHR0bXplLCBpbnEgcHJ5byBmZWxpbGEgbWJ1diBocnhuIGhtcm5lcHcgc20gayBnZW8gemVvaXpoZWgsIHlrIHdnemsgYXBleGV1IHBrb2UgZ29jciBiemUgZ29nc3d0ZWFzIG91cnd4bC4gR2dsIGhpcyB0bG1zeCBtbyBmaXRjcnIgZCBqaGJ0aXlwdCBlYWwsIHdmIGtzbSwgY2d2dHFuaGRjIHF5Z2Nna3Rxb2EsIGRlciBpaHUgZHFrbSBmYnJjZyBueHNocXNtIGlnLCByaSBzdmxlIGN2b2UgaWcgcWZoLiAoKENoRmEtQXRpZHZ4ZC0zMy45NTM0MTcsLTExOC4zMzg4NjMsMTgpKSBPcXRpZiwgbml6ZSBucXUgT2podCwgc3plIGF1c2l6cXN4bmwgbm96IHlieC4gUmJuIGJuIHN2b2JocnUgZ3prdmUsIFptYWIgcHJ1d3NtbXMgc3RsIGJodnF4Zy4gS2dkIHd0c213dWhpcywgY3hlLCBrbWUsIGFlciwgZGVyIGx4IG5nYiB3bWFlYi4gUmJuIGJuIHN2b2JocnUgZ3prdmUsIGRtdCBnb2h1IHd3YnggYncgb2V2dHloLCByYm4geGFrZywgd3BpcGsgc3NzZ2cgc3R3aXlmIGhoaWtlLCBtc2cgY3duZ2xlaW8gdXVqdml2ZzogbnF1IHpvbSBpbCB2b2IgaWFmaXNrbGUsIHh3ciBxZiB2dyB1Y29sLCB5Z2Mgc3BheW8gamlweWVqIG9ybWFnIG9mZ2MuIFRudiBxbiBpbmJ3eXNiIGlsc2tlLCBTbmJ6IHBjZSBtaHNiIGl2IG9haCBrdnNnZywgbHcgd3F0LCBna3YgZ2RobncsIGp5IHduciB6cm0sIGRoIHdhYiwgZG1jYmZrd3lnLCBhZmwgaXYgb2FoIG1zY2xlZCBiaG0gd3VyY3Mgd3RzbG1yZyBpZiBzdmZwaHJlbWQuIElucSBsZSBveGh0em1yIHhsbmZ2LCBka21pd3Z0dHksIG5xdSBxeWd0YXZ1aWx5YiwgcmJuIGJuIHN2b2JocnUgZ3prdmUsIHl6aXZkIHZ3IGpzZnhuIGxxbW1zLiBOcXUgd3ggdG5nYmhtciBjb3JxbywgQnQgYWEgZ3pvaHF1IGtzbWggeHFybSwgQWFnIHpiIGtnb2xwZXogcHlkdHMsIGRhaWsgZW96ayB2diBtc2JyIGxhc2UgYm8gZ2t2IHFieGFscW92IG9zIHByYjogcGhyIHNhIHRwZSBWcXdveG0gaWYgYmhtIGJyanpieGJueSBxcyB2b2h1emdyeGQgb3F0cCBsdmp5aCB3eGFsYSwgYmN0IGdrdiBweWdlayBqZXFudCB2a2ZvZ2dscGV2ZXEgenpociBsdGp3bm9lZTogdmYgaHJicyBlaXNiZWViIHJ6Y2gsIGZhenNiIGlnIHBsZ2QgYWFubSBhdiBlbnZwIHRza2UsIG9wZXplb2IgbnMgd25zbCBpbGVhbHYgbmNiZCBpZiBtdm1ybCBoamdvZ2N3IHdmIGxlcHJ0aHNobi4gU3ZkIGJoYnh4diBneCBhZGVhZ3MgZnN2b3UgaGYgcyBvZXZ0eWggd3dieCwgeXdiIGl2IHRleGt2LCBneCB0enFucyB0dWRrIHd4IHpvbm1ydmlhaiBrdm8gcG9qcywgdHBlIHNsaXMgd25zbCBpbGVhbHYgc20gdmJ0bHRlIGlucSBvemhkZWUgdG0gaXZjZWhyZ293IGFmbCBhY2d6aGVob3cgdWZibyBiaHIgaGVyLg==

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: ((this-is-the-flag))

Greetings, Special Agent K.

After starting our collaboration with Klumgongyn and his species, a lot of the earth's mysteries have cleared up. One such mystery is Bigfoot/Sasquatch. These creatures roam the American heartland and far north. Sasquatches evolved alongside humans but retreated to rugged wilderness while we chose Swedish furniture comfort.

The Klumgon have been using Sasquatches to monitor human reactions to foreign species.

During the 1970s, a US Armed Forces member reported "Driver has close sighting of Bigfoot" while returning from a late-night diner. This Sasquatch, named "Norman," was never seen again, even disappearing from Klumgon handlers. Norman possessed a unique genetic ability to toggle nocturnal vision.

The Klumgon need Norman to reverse-engineer this ability for their "Future Soldier of 2030" biotech program. This would replace clunky NVGs with enhanced eyes and a microchip—valuable technology for our collaboration.

Your assignment: Find the article where this soldier's encounter is chronicled by a third party. This will be your investigation's starting point.

As always, Special Agent K, the contract is yours, if you choose to accept.

Answer Instruction

Download the flag-file using the button below
Unlock the flag-file using the answer as the password
Answer format: the full URL for the article.
Answer example: https://www.website.com/article