Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Operation Slither

Follow the leads and find who's behind this operation.

Task 1: The Leader

We got access to a hacker forum and found the info of our company on sale! All the info we have is in this post. Find any information related to the leader of the Sneaky Viper group.

Full user database TryTelecomMe on sale!!!

As part of Operation Slither, we've been hiding for weeks in their network and have now started to exfiltrate information. 
This is just the beginning. We'll be releasing more data soon. Stay tuned!

@v3n0mbyt3_

---

Reconnaissance Guide

  • Begin with the provided username and perform a broad search across common social platforms.

  • Correlate discovered profiles to confirm ownership and authenticity.

  • Review interactions, posts, and replies for potential leads.

Answer the questions below

  1. Aside from Twitter / X, what other platform is used by v3n0mbyt3_? Answer in lowercase.

  2. What is the value of the flag?

Task 2: The Sidekick

A second message has been made public! Our accountt in their forum was deleted, so we couldn't get the operator's handle this time. Follow the crumbs from the first task and hunt any information related to the second operator of the group.

60GB of data owned by TryTelecomMe is now up for bidding!

Number of users: 64500000 Accepting all types of crypto
For takers, send your bid on Threads via this handle:

HIDDEN CONTENT 
----------------------------------------------------------------------------------------------------- 
You must register or log in to view this content

Reconnaissance Guide

  • Use related usernames or connections identified in earlier steps to expand reconnaissance.

  • Enumerate additional platforms for linked accounts and shared content.

  • Follow media or resource references across platforms to trace information flow.

Answer the questions below

  1. What is the username of the second operator talking to v3n0mbyt3 from the previous platform?

  2. What is the value of the flag?

Task 3: The Last Operator

A new post is up. Hunt the third operator using past discoveries and find any details related to the infrastructure used for the attack.

FOR SALE

Advanced automation scripts for phishing and initial access!

Inclusions:
- Terraform scripts for a resilient phishing infrastructure 
- Updated Google Phishlet (evilginx v3.0)
- GoPhish automation scripts
- Google MFA bypass script
- Google account enumerator
- Automated Google brute-forcing script
- Cobalt Strike aggressor scripts
- SentinelOne, CrowdStrike, Cortex XDR bypass payloads

PRICE: $1500
Accepting all types of crypto
Contact me on REDACTED@protonmail.com 

---

Reconnaissance Guide

  • Identify secondary accounts through visible interactions (likes, follows, collaborations).

  • Extend reconnaissance into developer or technical platforms associated with the identity.

  • Analyse activity history (such as repositories or commits) for embedded information.

Answer the questions below

  1. What is the handle of the third operator?

  2. What other platform does the third operator use? Answer in lowercase.

  3. What is the value of the flag?

Room Icon

Operation Slither

Follow the leads and find who's behind this operation.

easy

20 min

10,905

User profile photo.
User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

We got access to a hacker forum and found the info of our company on sale! All the info we have is in this post. Find any information related to the leader of the Sneaky Viper group.

Full user database TryTelecomMe on sale!!!

As part of Operation Slither, we've been hiding for weeks in their network and have now started to exfiltrate information. 
This is just the beginning. We'll be releasing more data soon. Stay tuned!

@v3n0mbyt3_

---

Reconnaissance Guide

  • Begin with the provided username and perform a broad search across common social platforms.

  • Correlate discovered profiles to confirm ownership and authenticity.

  • Review interactions, posts, and replies for potential leads.

Answer the questions below

Aside from Twitter / X, what other platform is used by v3n0mbyt3_? Answer in lowercase.

What is the value of the flag?

A second message has been made public! Our accountt in their forum was deleted, so we couldn't get the operator's handle this time. Follow the crumbs from the first task and hunt any information related to the second operator of the group.

60GB of data owned by TryTelecomMe is now up for bidding!

Number of users: 64500000 Accepting all types of crypto
For takers, send your bid on Threads via this handle:

HIDDEN CONTENT 
----------------------------------------------------------------------------------------------------- 
You must register or log in to view this content

Reconnaissance Guide

  • Use related usernames or connections identified in earlier steps to expand reconnaissance.

  • Enumerate additional platforms for linked accounts and shared content.

  • Follow media or resource references across platforms to trace information flow.

Answer the questions below

What is the username of the second operator talking to v3n0mbyt3 from the previous platform?

What is the value of the flag?

A new post is up. Hunt the third operator using past discoveries and find any details related to the infrastructure used for the attack.

FOR SALE

Advanced automation scripts for phishing and initial access!

Inclusions:
- Terraform scripts for a resilient phishing infrastructure 
- Updated Google Phishlet (evilginx v3.0)
- GoPhish automation scripts
- Google MFA bypass script
- Google account enumerator
- Automated Google brute-forcing script
- Cobalt Strike aggressor scripts
- SentinelOne, CrowdStrike, Cortex XDR bypass payloads

PRICE: $1500
Accepting all types of crypto
Contact me on REDACTED@protonmail.com 

---

Reconnaissance Guide

  • Identify secondary accounts through visible interactions (likes, follows, collaborations).

  • Extend reconnaissance into developer or technical platforms associated with the identity.

  • Analyse activity history (such as repositories or commits) for embedded information.

Answer the questions below

What is the handle of the third operator?

What other platform does the third operator use? Answer in lowercase.

What is the value of the flag?