Infected

بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ

Challenge Brief

A sophisticated APT group known as 0n3Sh0t has been operating a custom infostealer dubbed Shad0wEXF (Shadow Exfiltration) across the MENA region, targeting finance, banking, software, retail, and healthcare sectors. Intelligence indicates they recently compromised GAB — Gulf Arab Bank, one of the region's most prestigious financial institutions. The SOC team at GAB discovered anomalous outbound traffic from an internal workstation sending HTTP POST requests to an unfamiliar external IP address. Investigation revealed the workstation was exfiltrating company databases to a remote Command-and-Control server hosted on AWS infrastructure.

You have been provided with a network traffic capture from the GAB corporate network. The company operates across three internal department VLANs: 10.16.0.0/24 (Engineering), 10.32.0.0/24 (Finance), and 10.85.0.0/16 (General Staff). One workstation has been compromised and is exfiltrating data to an external malicious server.

Upon examining the C2 server, a misconfigured nginx instance with directory listing enabled exposed the attacker's operational infrastructure: uploaded databases, encrypted operational logs, and email correspondence — all pointing to a darknet marketplace called GraveMirror, operated by a threat actor known as shayblaban, where stolen data is auctioned to buyers.

Your mission: trace the exfiltration path in the capture, investigate the C2, crack the attacker's archives, locate the marketplace, and recover critical intelligence about the highest-value individual in the leaked GAB dataset.

Flag Parts :
1st Flag Part: The internal IP address of the compromised workstation that is exfiltrating data to the C2 server.
2nd Flag Part: The external IP address of the malicious C2 server receiving the exfiltrated databases.
3rd Flag Part: The password used to encrypt the operational logs archive found on the C2 server.
4th Flag Part: The Bitcoin wallet address belonging to the threat actor shayblaban, used for receiving marketplace commissions.
5th Flag Part: The ISO 3166-1 alpha-2 country code of the wealthiest individual found in the GAB data leak.
6th Flag Part: The phone number (including country code) of the same wealthiest individual from the GAB leak.

Flag Format :
EYCC{1st_2nd_3rd_4th_5th_6th}

TL;DR

The full exploitation and investigation chain:

1. PCAP Analysis
2. C2 Identification
3. C2 Investigation
4. Reading Exposed Emails
5. Cracking Encrypted Logs
6. Identifying Onion Marketplace
7. Logging in with Leaked Credentials
8. Downloading Leaked GAB Database Sample

Critical Points Extracted

1. We have a PCAP capture of Gulf Arab Bank traffic across three internal VLANs (10.16.0.0/24, 10.32.0.0/24, 10.85.0.0/16).
2. A compromised device is sending HTTP traffic to a malicious C2 server.
3. The C2 IP hosts an exposed Nginx directory listing.
4. We need to locate and crack an encrypted logs archive to discover the marketplace’s .onion domain.
5. We must log in to the marketplace to extract information on the highest-value individual in the leaked database.

Phase 1 — Wireshark Network Analysis

Opening the PCAP file in Wireshark shows various network protocols:

Exporting HTTP objects (File -> Export Objects -> HTTP):

Following the HTTP stream of the file upload request:

We observe an upload of GAB_Financial_Records.parquet.enc, identifying the infected workstation and the receiving C2 endpoint:

• Part 1 (Compromised Device IP): 10.32.0.45
• Part 2 (C2 Server IP): 3.92.146.245

Phase 2 — C2 Server Investigation

Visiting http://3.92.146.245 reveals an open directory listing:

Checking the /emails/ directory reveals 8 email files:

Reviewing the Correspondence

Email 1

From: [email protected]
To: [email protected]
Subject: Partnership Proposal - 0n3Sh0t Data Operations
Date: Tue, 08 Jul 2026 14:23:11 +0000

Hey,
My name is Sunch1n3ese, I'm the seller representative for the 0n3Sh0t APT group. We've been following your marketplace for a while and think it's the right place for what we have coming. Over the past 6 months we developed an infostealer that's been widely deployed across the MENA region. Corporate networks, government contractors, financial institutions - we've hit a lot of targets.

Email 2

From: [email protected]
To: [email protected]
Subject: Re: Partnership Proposal - 0n3Sh0t Data Operations
Date: Wed, 09 Jul 2026 09:47:33 +0000

Sunch1n3ese,
For every database you sell, I take a 10% commission off the asking price. You set the price, I take my cut, you get the rest. Clean and simple.
- shayblaban

Email 3

From: [email protected]
To: [email protected]
Subject: Re: Partnership Proposal - 0n3Sh0t Data Operations
Date: Thu, 10 Jul 2026 11:05:42 +0000

shayblaban,
10% is fair. We agree to those terms. We have an internal upload tool that pushes databases directly to your server over Tor...

Email 4

From: [email protected]
To: [email protected]
Subject: Re: Partnership Proposal - 0n3Sh0t Data Operations
Date: Sat, 12 Jul 2026 16:31:08 +0000

Here's my BTC wallet for commission settlements:
bc1q5v2x8r3m9kp4tnyjwl8fg2d6h7c0zq3x8mr5ay

Here are your marketplace credentials:
Username: Sunch1n3ese
Password: Tr@deR1sk2026!

Email 7

From: [email protected]
To: [email protected]
Subject: Re: Partnership Proposal - 0n3Sh0t Data Operations
Date: Wed, 23 Jul 2026 15:17:52 +0000

We exfiltrated 1.2 million records from GAB - Gulf Arab Bank. One of the most prestigious banks in the MENA region. The data includes account holders, transaction histories, portfolio allocations, and internal compliance records...
This one is not going up with a static price. This is a live auction. Starting price: 12 BTC. Bidding closes July 29, 2026.

Email 8

From: [email protected]
To: [email protected]
Subject: Security Notice - Credential Rotation
Date: Wed, 23 Jul 2026 18:45:33 +0000

Your new credentials:
Username: Sunch1n3ese
Password: N3w_R1sk!2026z

Key Findings from Emails

• Part 4 (Threat Actor BTC Wallet): bc1q5v2x8r3m9kp4tnyjwl8fg2d6h7c0zq3x8mr5ay
• Active Marketplace Credentials: Sunch1n3ese : N3w_R1sk!2026z

Examining /uploads/ and /logs/

The /uploads/ directory contains staging databases:

The /logs/ directory contains an encrypted logs.7z archive:

We extract the hash using 7z2john and crack it using John the Ripper:

7z2john logs.7z > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt --fork=8

• Part 3 (Logs Archive Password): angel66

Extracting logs.7z and inspecting the log files exposes the darknet marketplace URL:

Phase 3 — Darknet Marketplace Investigation

Opening the .onion domain via Tor brings up the login portal:

Logging in with credentials Sunch1n3ese : N3w_R1sk!2026z:

Navigating to private seller communications reveals a negotiation chat with the highest bidder requesting a larger sample:

Downloading the 10,000-record dataset sample and querying for the highest net-worth individual:

Extracted Target Information

• Name: Sauod Ben Kahtan

• Country: Qatar (QA)

• Phone Number: +97455123456

• Part 5 (ISO 3166-1 Alpha-2 Country Code): QA

• Part 6 (Phone Number): +97455123456

Final Flag

EYCC{10.32.0.45_3.92.146.245_angel66_bc1q5v2x8r3m9kp4tnyjwl8fg2d6h7c0zq3x8mr5ay_QA_+97455123456}