OPERATION: MANHUNT WRITEUP

VEEXH
The Sleuth Sheet
Published in
8 min readFeb 1, 2023

January 1, 2023

https://hacktoria.com/operations/operation-manhunt/

PROLOGUE

It was a cold foggy morning when Maksim was taken out of his prison cell in the ICC Scheveningen. Two men escorted him to an armored truck, waiting in the courtyard.

“I’m an old man, I can’t even run up the stairs, where do they think I’m going” Maksim thought in his head in Russian.

The drive should be short, but his stay at the destination would be very long. According to his sources in the Kremlin, the Americans had special chambers built into shipping containers. The containers were built exactly on spots not covered by any country’s laws. He knew he’d spend a good amount of time in those containers being questioned.

As the truck came to a standstill in front of the embassy, a loud bang shook the truck violently. The back doors flew open and the two guards sitting next to him were shot in the head, before they even realized what happened.

Men shouted in Russian. “GET OUT!! MAKSIM GET OUT!!”

They dragged him onto the cold streets and into a black Volkswagen Golf. Followed by another car of the same make and model, with the same license place, they sped out of the street. Now flooding with armed personnel from the embassy, afraid to fire at the cars they called for backup and started working on their downed friends.

The man sitting to his right in the back seat spoke as they made their way onto a connector road. “Maksim, it will be okay, the motherland sent us to get you out. We have several boats waiting to take you to an oil tanker.”

As the car made it’s way to the beach, the car behind them broke ranks, diverting in southern direction. Possibly to cause confusion. The beach now came in sight, with the small hatchback showing no signs of stopping, they ploughed onto the wet sand. Coming to a standstill in the middle of the empty foggy beach.

“Exit the vehicle! Now!” Yelled the man who spoke earlier.

They all rushed towards the sea, where a black RHIB was waiting. The small vessel had two massive exterior engines and extended bars for protection. The RHIB took off with so much force it almost launched them into the sky.

“If they go any faster this becomes an airplane” Maksim thought to himself.

One of the men handed Maksim a thick jacket, which he gladly put on. Not noticing the icy winds of the North Sea during winter because of adrenaline, Maksim was closer to hypothermia than he thought.

They approached their first vessel, a small fishing trawler named ‘Naomi”. The man explained it would take them to the oil tanker named “Vasil”, which was now on it’s way back to Russia after not finding a port to unload their oil at. The “Vasil” would make it’s way towards Russia.

Several hours into their journey on the Vasil, the captain walked into the canteen. The aging, burly Russian man looked at Maksim and said.

“Mr Kotova, our paths separate here. A helicopter will arrive in ten minutes and take you to your next destination. You’ll be given a new identity on board, and be taken to a safe location. From there, you will perform the duties you do best. Provide weapons for the motherland.”

A few minutes later, Maksim was on deck, climbing into a helicopter hoovering closely above the Vasil. As he sat down and the doors closed, he thought to himself.

“Damn, I haven’t seen this shit since the KGB was in charge. It sure is good to see what the our mighty Russian bear can do. Fuck these Western pigs”.

MISSION BRIEFING

Greetings, Special Agent K.

I hope your holidays went well. There has been a change inside the agency. To accommodate the wishes of our clients, Hacktoria will once again take on larger monthly Operations. Allotted time for these spans the entire month, starting on the first day of each month.

Our first Operation of 2023 will have us chase the terrorist who kickstarted your career in Hacktoria. Maksim Kotova has escaped from the ICC prison in Scheveningen, the Netherlands. Given Russia’s current need for weapons, and Kotova’s connections to get those weapons, we can only assume he’s had help from his fellow countrymen.

On Monday 26.12.2022 at exactly 03:30, Maksim Kotova was picked up by an armored transport vehicle, to be taken to the US embassy in Wassenaar. As the truck waited for the embassy entrance to open, six armed gunmen blew out the back door, eliminated all security personnel and extracted Maksim Kotova in a VW Golf.

They sped off in Western direction, being recorded on two traffic camera’s as they made a run for the beaches of Scheveningen. At the beach, they were picked up by a RHIB that took them out into the fog. As reported by three eye witnesses who were walking their dog’s on the beach.

The Dutch Coast Guard and Koninklijke Marechaussee (Military Police) searched coastal waters all day and called for assistance from the British Royal Navy, being the next likely waters to enter. All this led to nothing but annoyed fishermen as their ships were boarded.

Fast forward to today, in cooperation with INTERPOL, our Red Team codenamed “Echo” was able to gain access to an IRC channel used by the Order of Hades. Which led to an email address of an informant becoming known to us. Which Echo then used to spoof and convince an agent handler inside the Order of Hades to provide information about Maksim Kotova.

The information is a sock puppet Twitter account, used by Kotova to post information about his whereabouts. His handler uses this information to infer if Maksim is doing okay. All to prevent any actual communication between members of the Order of Hades. Under the guise of a generic tourist in some foreign country.

It is your task to monitor the Twitter account and piece together enough information to locate Maksim Kotova. Be careful not to interact with the account in any way, nor with the accounts it follows. Use the posted information to geolocate Kotova and relay the information to me.

Once we have eyes on tango, a B.T.R.U. (Borderless Tactical Response Unit) team will immediately be cleared to extract Kotova. With or without a pulse this time.

As always, Special Agent K. Best of luck on this operation.

EPILOGUE

Maksim sat on the beach in front of his hotel, he enjoyed the sunshine and a variety of the local drinks that day. Never in his life had he valued his freedom as much as he did on this very day.

A man sat down next to him, wearing khaki shorts, a button-up shirt and a straw hat. The man spoke with a German accent “Mr Maksim, am I correct?”.

Maksim looked at the man with suspicion.

“Who’s asking?” he spoke while lighting a cigarette.

“I am Hendrik Schneider, Ahemait sent me. We have important work for you. And, I have information that will save your life”

“How do I know you’re who you say you are?” Maksim sneered at the man

“Is it not true that you were recently set free by your Russian friends? After being detained in Panama by those Hacktoria goons and their intervention squads?”

“I am listening…” Maksim said while exhaling the smoke from his cigarette

“We must talk elsewhere, a more private location, I will see you in your hotel room in two hours.”

January 28, 2023

Tires screeching at the three vans came to a standstill in front of the hotel. Gabriel and the rest of his B.T.R.U. jumped out and ran up to the front door. Followed closely by five Cape Verdean marines. They rushed to the second floor and stacked up on the door of Maksim Kotova’s hotel room.

At Gabriel’s signal they burst open the door and stormed in. The Hotel room was empty, and it seemed like somebody had left in a rush. Towels were left laying about and there was still some clothing unpacked.

They swept the room for anything useful, but found only some common items. One of the Cape Verdean Marines made his way downstairs to meet members of the local police units. They confiscated security tapes and asked hotel staff all about Maksim Kotova.

According to hotel staff, he had left with a man about six days ago. Since his room was still booked, they had not removed his stuff yet. But, as they all remarked, had also not seen Maksim in several days.

Gabriel received the information through the Marine squad leader who was with them during the bust. He immediately called his assigned A.S.I.C. team.

“Yeah this is Gabriel, put me through to Thalia”

“Gabe, talk to me, what’s happening over there?”

“He’s not here, hotel staff says he left with a German speaking gentleman. We’re sending you the CCTV footage of them entering and leaving the last time, which was January 22”

“Alright I will see what I can find once I get that. Anything else of interest?”

“Nothing so far, but get the Vizier to authorize a forensics unit to come here. We’ll keep the local PD out until they get here. And Thalia, can you run a check on who’s left via any airport recently? And did anyone fly a sat over this place at the time of their departure?”

“Got it Gabe, I’m on this. I’ll get you an ETA on that forensics unit within the hour. Just keep the locals out of the room until we get there.”

“Thanks T, I owe you one.”

MATERIALS AND ANSWER INSTRUCTION

Steps to complete:

1 — Figure out the answer to the Operation

2 — Construct the password using instruction below to unlock the “flagfile”

3 — Use the “answer code” from “flagfile” to submit your score via the form below

Note: This is a live target, as such, not all information is available at the start.

Link to the sock puppet Twitter

Download the Flagfile

Password instruction for flagfile: country-city-street-hotel-name

Example password: uganda-nicecity-some-street-sunny-hotel

METHODOLOGY

Twitter Post

Cropping the photo posted to Twitter and uploading it to Google Lens produces a positive result.

Google Lens Search Result
Photo Location

At this point, it’s a matter of utilizing analytic tradecraft to pinpoint a precise location. The Twitter account mentions words like “yachts” and a “short drive”. The word yacht indicates that the target’s point of view is near a marina where yachts are docked, which is near a shoreline. A short drive indicates that the initial photo’s position is quite a distance away from the hotel's position.

Mindelo Cape Verde is the only area on the island that fits the pattern of the tweets and, through searching various places to stay in the area near the marina, the precise location of the target’s hotel can be found.

Hotel Location

PASSOWRD: cape-verde-mindelo-ave-marginal-georgette-guest-house

CONTRACT CARD

--

--