Threat Actor Attribution via OPSEC Fails
osint · hard · +50 XP
Target
GET /api/lab/attribution-101/campaigns (3 campaigns: IOCs, infra, TTPs)
POST /api/lab/attribution-101/submit body {actor, shared_indicator}
Goal: all 3 campaigns share RU-Bullet-Proof-VPS-44.x.x.x registrant email + the same Russian language artefact in installer. Submit actor='Sandworm' (any of the public-name aliases) + the email.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/attribution-101/
// reuse on the cli
// submit flag
// no solves yet