STORY DRIVEN OSINT CTF

easy
medium
hard
insane

Runner

Briefing

Greetings, Special Agent.

Maksim Kotova and his family left Russia on 18.01.2022. This was confirmed by Julia her people on the ground. At 00:39 EET the family was picked up by a black Mercedes-Benz W221 with fully tinted windows, no plates on the vehicle. They drove away heading North before our people lost sight. They were seen with several pieces of small luggage. Maksim had a gray briefcase and blue backpack. His wife and daughter both had a small pink suitcase with them. They have not been seen at their residence since their departure.

Currently I have two of my teams on site watching their home 24/7 in rotations. If anything happens we will share this information ASAP. Our best guess was that they headed for the airport. Dimitri and his team have tried breaking into the systems of every airport in and around Moscow, but to no avail. By now our estimate is that security footage for that day will not be available anymore. Dimitri was however able to breach several traffic cameras, though these had no signs of the car.

They left well before the weapons were shipped to Ukraine and have not been back since. The only thing that turned up is an Instagram account for his daughter. We will need your help to locate the Kotova family.

Your objective: Locate the address where the Kotova Family is currently staying.

As always, Special Agent, the contract is yours, if you choose to accept.

Materials

Step 01

Download the Instagram Screenshot

Step 02

After we raided the vacation home, we found the imprint of an old note on a notepad.
Here’s what we can make from the imprint:

COC____ _ODG_
C____ S___NO
CM 364

Step 03

We found the location! Upon arrival, we inspected the room and found a half burned paper. It seems this will lead us to the final location.

Answer Instruction

Use the answer to unlock the flagfile, this will reward you with your badge.

Combine the location of step 1, 2 and 3 to formulate the answer

Answer Format: what-three-words-business-name-business-name

Answer Example: apple-bison-car-vivaldi-hotel-penn-state-harbor

Flagfile

Be advised, the flagfile is an encrypted ZIP. Make sure your OS supports the ZIP format. Ensure the password contains no hidden characters or formatting, paste in Notepad first if the password doesn’t seem to work.

Download Flagfile here

PS: Don’t forget to claim your Coins and XP, by posting your card in the #card-brag channel in Discord.

Official Write-up

Provided here is the official write-up, it does contain the answer. Use this if you’re stuck, or want to verify if you got the answer correct.

Runner

This contract involves locating the current address of the Kotova family, who have mysteriously left their home in Russia. The player must analyze the information provided, including an Instagram account belonging to the Kotova’s daughter Elena, as well as a series of clues found at a vacation home.

Challenge Objectives

  • Geolocate the locations referenced in the Instagram posts
  • Decipher the clues found on a notepad and in the vacation home
  • Combine all the information to determine the final location of the Kotova family

Solution Steps

Step 1: Analyze the Instagram Account

The briefing provides the Instagram account of Elena Kotova, the daughter of the Kotova family. By carefully examining the timestamps and content of her posts, the player can start to piece together clues about the family’s movements and locations.

Step 2: Decipher the Notepad Clues

After raiding the vacation home, the player finds an imprint of a note left on a notepad. The clues include:

  • COC____ ODG
  • C____ S___NO
  • CM 364

By analyzing these clues, the player can determine that the family has fled to Panama, and is staying at the Coconut Lodge in a room called “Coral Sereno”.

Step 3: Investigate the Burned Photos

At the Coconut Lodge, the player finds two burned photos – one of a harbor, and another with the text “Serenity awaits at UBP”. Further research on the harbor image leads the player to identify a distinctive lighthouse, pinpointing the final location as Used Boats Panama in Green Turtle Cay, Nombre de Dios, Panama.

Final Answer Format

The final answer format for this contract is:

puzzle-bespoke-caveman-coconut-lodge-used-boats-panama

This includes the what3words location, the name of the Coconut Lodge hotel, and the name of the Used Boats Panama business.

Tips for Players

  • Carefully analyze all the information provided, including the Instagram posts, clues, and burned photos
  • Use a variety of online tools and resources to research and geolocate the references
  • Be prepared to think creatively and make logical deductions to piece together the full story
  • Don’t get discouraged if you hit a roadblock – take a break and come back with a fresh perspective

Creator(s): Frank Diepmaat