Hey everyone!
This challenge has to be one of my all-time favorites. Not only does it dive into the world of serial killers, but it also adds in some biology, which is right up my alley! What made this CTF so interesting was its structure — it felt like an serial killer series, with every step leading more and more into the killer’s world. Without further ado, let’s jump into this gripping case and dissect the steps😊!
𝗕𝗥𝗜𝗘𝗙𝗜𝗡𝗚
Greetings, Special Agent.
So bit of a different task we got on our hands this time. The local Police Department has their hands full with a murderer. New cases every week, severed limbs and cut eyes and all, very horrible stuff. Due to the nature of the killings, public pressure is mounting and the city is rapidly panicking. Your task is simple, catch the killer. Below you’ll find the summary of the killings up until this point, the victims and timeline of events. Good luck on this one, there’s a lot of pressure on this.As always, Special Agent, the contract is yours, if you choose to accept.
Step One: Identifying the Killer’s Victims
The first step of the challenge was to figure out what all the victims had in common, and I’ll admit, this had me hooked right away.I have watched an unhalthy amount of serial killer movies and series which made me think that serial killers almost always have a type, so I dug into the police report, looking for patterns or shared traits among the victims.
After going through the details a few times, something clicked. All the victims had heterochromia — a condition where someone has two differently colored eyes. It’s a rare and striking feature, and it stood out immediately once I spotted it. Heterochromia can be genetic or caused by health conditions, but in this case, it seems to have made the victims stand out in the worst way possible.
That realization answered the first question: the victims were all targeted because of their heterochromia. I was happy that the movies didn’t let me down. With that in mind, I couldn’t wait to move on and see where this case would lead next.
Step Two: Tracking the Locations
Alright not sure how you’re getting on with figuring out why these people are targeted, but we believe the killer just left us another clue. We received the follow message with 3 attached images: “You missed a few, they deserve to rest properly” Below are the images of the three locations, identify where these are so the local police units can look for bodies. We need the names of the locations.
The next task was to identify three locations based on images we were given. This was a fun mix of logic and resourcefulness, and I couldn’t wait to get started.
The first image was straightforward. I uploaded it to Google Lens, and just like that, it revealed the location as Loretto Hospital in Chicago, Illinois. That felt almost too easy, but I wasn’t complaining.
The second image followed the same pattern. I ran it through a reverse image search, and it quickly identified the place as Mount Emblem Cemetery in Elmhurst, Illinois. Two down, and things were going smoothly.
Then came the third image, and that’s where things got interesting. This one didn’t yield any useful results on the first attempt, so I knew I’d need to dig deeper. The image showed a football training facility with a building in the background that had a logo on it. The logo seemed like the key, so I zoomed in and ran a reverse search for it.
After some scrolling, I found a logo that matched most of the details — the same colors and text, but it was missing the sword. Still, it was close enough to pursue which led to their old logo with the sword. The logo belonged to the North Park University Vikings, the athletics department of North Park University.
I switched to Google Maps and started exploring the university’s campus. Their page had a 360-degree view of the facility, and after some searching, I found the exact location from the image.
With all three locations identified, I felt a real sense of accomplishment.On to the next…….
Step Three: Decoding the Killer’s Message
Excellent work on finding the locations, the state of the victims matches the killers MO exactly. In a twist of fate, or by the hands of the killer, we’ve received an anonymous tip regarding a video that surfaced. It’s on a completely new YouTube channel, no other content posted, we believe the account to be a sock puppet. We need you to find out the meaning of the video on this channel. Does this get us anywhere?
This step was both chilling and fascinating. We were tasked with uncovering the meaning behind a cryptic message sent by the killer, accompanied by a link to a YouTube video titled “They Are Here”. The video supposedly depicted an alleged UFO sighting in Hawaii, but something about it felt off. The eerie background noise immediately caught my attention, and I suspected there was more to it than met the eye — or ear.
The first thing I did was download the video and extract the audio file for closer analysis. From my experience with previous challenges, I knew that hidden messages in audio files often show up in a spectrogram, a visual representation of sound frequencies. I used Sonic Visualiser for this challenege. But various tools like Audacity and web based tools like dcode and Spectrum Analyzer also does the job.
As I loaded the audio file into Sonic Visualiser and switched to spectrogram view, a pattern began to emerge. There it was: a series of letters forming a URL, ie theyarehereamongus.blogspot.com. The message led me to a blog titled “They Are Here Among Us” on Blogspot, run by someone calling themselves Alien Catcher.
The blog itself was a rabbit hole of paranoia and delusion. The author — clearly our killer — had constructed an elaborate theory claiming that people with heterochromia were “aliens in disguise.” It was horrifying to think that this delusion was fueling their murders.
As I read through the posts, it became clear that the blog documented the killer’s warped rationale and provided a timeline of their actions. The writing detailed their methods and chilling justification, believing they were saving humanity by eliminating these so-called “aliens. This step wasn’t just about finding a clue — it was about diving deep into the mind of the person we were hunting.
Step Four: Tracking the Missing Victim
Amazing job on finding the meaning of that message. Local PD was chasing down a rabbit hole deep enough to come out China, excellent work. So we just got word of a new missing person, her name is Julia Morena, 35 years old from 210–200 W 4th St, Hinsdale, IL 60521. Julia never arrived for her evening shift at the hospital two days ago, her coworkers couldn’t reach her so they contacted her family. After getting nowhere, they contacted us. Please locate Julia and find out if her disappearance is related to the killings. We will need her location, dead or alive unfortunately. I suggest you keep an eye out in case the killer posts something about this.
The first clue I thought to revisit was the killer’s blog, which had already provided crucial insights. It didn’t take long to find what I was looking for: a new post on the blog. The post didn’t mention Julia directly, but it was full of cryptic writing, consistent with the killer’s deranged style. As I scrolled, I noticed something odd — certain letters were italicized within the text.
Intrigued, I started writing down the italicized letters. The string of letters spelled out: “fills ballots necks.” At first, this phrase didn’t make any sense. It felt like a dead end, and I started doubting whether it meant anything at all. Then I did a search in google like ‘three words location’ which led me to a tool called What3Words, a mapping service that divides the entire world into 3-meter squares, each labeled with a unique combination of three words.
It worked!! the fills ballots necks was the coordinates for the Laramie Park in Chicago.But it comes with a bad news that the victim has deceased.
Step Five: Unraveling the Note
Alright so big hit today! There was a note found at the local university, people got suspicious at the request stated on this note and contacted the local police. The person stated on the note is not familiar at the university, the needed email address had also been cut off. We sent the original note for forensic analysis to the lab, this will however take several days. Attached below you find a typed out copy of the note as found in the university.
The note mentioned a name: Marlene Esther-Obdam. My first instinct was to look for any social media presence tied to that name. I used Blackbird, a tool similar to Sherlock, to scan for usernames across various platforms. I tried different combinations of the name, with and without underscores, rearranged the first and last names,etc.
After some trial and error, I got a hit for the username: marleneobdam. It belonged to a Twitter (now X) account, and while it wasn’t overflowing with information, it offered a few breadcrumbs worth exploring.
Step Six: The Final Puzzle
After looking at CCTV footage, we have identified the killer to be Kaylee Ann Taylor, a 41 year old DevOps engineer at the university. Local police raided her residence, but found nobody there except her pets. Speaking to her neighbors, it turns out she left town and asked them to take care of her home for a while. So far we are investigating the house and surrounding area.
Local police has taken a laptop that was left behind, this device contained a lot of files that are being looked into. However, one file on the desktop immediately stood out. So far our Red Team has not brute-forced it yet, perhaps you can have a crack at it using your knowledge of the subject? In the meantime, we’ll be checking for credit card payments, cellphone calls and local traffic cameras’. BOLO went out already and all Chicago news outlets will plaster her face on every screen possible.
Find out where Kaylee Ann Taylor is hiding.
In this step, I got a password-protected zip file containing the flight ticket of the suspect. This was the key to figuring out her next move. I started by retracing my steps through all the previous hints, scouring for a potential password. Unfortunately, none of them worked. I hit a frustrating mental wall and decided to take a break to clear my mind.
When I returned to the task, I decided to look at her Twitter account again. One of her earliest posts stood out — it mentioned her three pet cats and their names. It seemed like a possible lead. I started testing each cat’s name individually as the password, but no luck. Then I tried combinations of two names, hoping that might crack it, but still, nothing.
Finally, as a last-ditch effort, I typed all three names together. Voila! It worked! The zip file unlocked, and inside was the flight ticket. It was a one-way ticket from Chicago to Reno/Tahoe.
Step 7: Tracking the Killer’s Hideout
Now, the final part of the challenge — the flag file password. This was the moment I had been building up to: uncovering the location where the killer was hiding. The lead came from a Twitter image she posted, suggesting that she might be holed up somewhere specific. But as you can imagine, this wasn’t going to be easy.
The image was tricky. At first glance, it didn’t give away much — there was an electric post, a mountain range in the background, some stones arranged in a straight line, and a few concrete pillars. Off in the distance, there were some patches of vegetation and a couple of yellow trucks. At first, I focused on the trucks, thinking they might lead me to something. But that turned out to be a wild goose chase, as they didn’t provide any real clues. A mental wall AGAIN!!!!
After some days apart I came back again to the challenge this time i went a diffrent route:I started a reverse image search for the photo and quickly saw many hits for locations in Death Valley. As I scrolled through the images, I noticed that some of them showed RVs parked within a rectangular separation of rocks — which has some resemblance to the rocls in the image from the Twitter post. I started researching more on this and came to know that some RV parks use rocks to separate parking spaces.This is a far fetched theory but it’s the only one I got.I began searching for RV parks in the state of Nevada which has the infamous Area-51 the hub for all extraterrestrial theories.It made sense that our killer, with her warped mindset of “alien hunting,” would choose such a remote location. Her delusion of targeting people with heterochromia as “aliens” led her to this place, thinking it was the perfect hiding spot.
I sifted through the street views of several RV parks — about 10 to 15 in total — because I knew the image she posted likely depicted her view, meaning the location she’s hiding at is opposite to that. After reviewing all the options, I found one that matched the rocks, concrete boulders, and mountain range seen in the image: Space Station RV Park, located at 400 US-95, Beatty, NV 89003, United States.
Once I had the address, I was able to put it into the flag format, which required the name of the location, ZIP code, city, state, and country. The final flag was:
space-station-rv-park-89003-beatty-nevada-usa.
FINAL THOUGHTS
As said in the beginning it was one of my most favorite challenge of all time.From identifying the common thread between the victims to unraveling the twisted logic of a killer, each step felt like solving a new piece of a dark puzzle.The way the challenge was structured takes us through a number of tools and also number of choices to pivot on.
This challenge really tested my OSINT skills, patience, and ability to think outside the box, and I couldn’t be happier to have cracked it. It was a long ride, but the satisfaction of solving it made the entire journey worth it.And with that, the case is closed — until the next one.
I had a blast solving this challenge, and I hope you enjoyed reading about it as much as I did! You should definitely check out more intriguing challenges at https://hacktoria.com/—there’s always something exciting waiting for you. As always, if you solved it in a different way or have any questions, feel free to reach out to me on X or Discord @Intelbadger. Until next time, happy hunting!
