Operation Brutus.

Mission Briefing

from: juless555@tiberianserpent.com
to: tmp-agnt007@tiberianserpent.com
date: March 01, 2022, 21:00 EET
subject: Briefing Operation Brutus

Hi,

Glad we’re able to get some resources for this, your department must be swamped right now with that shitshow going on. After a chase across the globe we were finally able to capture Maksim Kotova. He collaborated nicely, though given the current political climate and location of his arrest, he’s been detained in an undisclosed location.

Besides ratting out a few very high level government officials and people active as spies inside various western governments, Maksim gave us some intelligence on a wildlife smuggling operation. He didn’t know too much about it, but was contacted at some point to take part. Apparently he had some decency, because even he thought this was horrible and didn’t want any of it. He was however able to get us a “handler file”.

These files are a collection of information intended for the person in charge of the whole operation, from where the animals are hunted to wherever people buy them. Among the files are hunting grounds, destinations and also personal files in an encrypted folder. These belonged to the previous handler who fucked up his Op-Sec, they made him swim with fishes. It’s probably nothing important, but it was in there non-the-less. We will need your help in mapping this entire operation, this hopefully leads to a lot of arrests.

attached was a file with pictures of both the destination and hunting areas, along with a password protected zip file.

Answer Sheet

Callsign / Username *

Scientific name of the animal and subspecies *

Location of the hunter camp *

Location of the hunting grounds *

Harbor location the shipment leaves from *

Harbor location the shipment arrives in *

Location of the market *

Date and time of arrival *

Shipment ID *

Name of the ship *

Shipment handler full name *

Shipment handler personal phone number *

Shipment handler personal e-mail *

Name of contact at the market *

Description of contact at the market (visual) *

Theses are my notes.

• Found phone number on image 4 15815059912

-Assuming Chinese number location is Shantou, Guangdong, (I assume that because of the characters on the sign)

-Opened file called shipping handler instruction, it was locked on the drop box but I downloaded it and was able to extract the info.

-”Hi, Here’s a quick note on hunting and shipping this month. The usual hunting grounds and animals,
this time may bring a Sheng language interpreter, call +254 41 555 555 0 if needed. Once you have 200 animals,
schedule the shipment and make sure you have the tracking details ready for the customer on the website
. Your marketing contact is Wendy Liu who will bring her ID and wait at the dock. At some point,
she may email you information about the shipment ID. Don’t worry she can speak Chinese, not English this time.
She has local transportation arrangements to transport the goods to the market. She will be wearing a blue raincoat
and red scarf for identification.”

-Phone number in file in file leads to Kenya 254 411 555 555 0

• Looking at the hunter photos the camp street view seems to be by a mosque.

• I found the departure harbor by accident, figured out there is one port in Kenya and then just looked around the harbor.
  for Kilindini Harbour

-Googled man made ports in China because of how square everything was. that pulled up Tianjian, looked around and I found the income dock
38.982085251330474, 117.72776486529463

-Get rick rolled while searching the website panderoshipping.cf contact info at midnight.

So then we back I got on way back machine to look up contact info and address and low and behold there’s a archive of the site.
80 Strand Street
Cape Town 8001
Hours
Monday–Friday: 9:00AM–5:00PM
Saturday & Sunday: 11:00AM–3:00PM
Email: info@panderoshipping.cf
Or Alternatively, reach out to Oliver directly:
Oliver Zeis (Leung)
oliverzeis@protonmail.com
+852 4124 9131

-With some help from r/kenya they led me right to the Bagh Ali shah Mosque, which is the neighbor to our camp
-3.7208522719210215, 39.029327219893275

-Fired up google earth pro and found started looking towards wildlife preserves and just happened to spot the 90 degree angle in the fence
hunting ground 3°38’59.04″S 38°59’3.04″E, 3°39’14.21″S 38°58’16.74″E

-Worked on the password for the personal file forever finally found a hint on twitter about hidden info in jpeg photos using hex. Its was really interesting here it is if you want to read it https://blog.nviso.eu/2020/07/13/how-to-embed-secret-data-in-jpeg-files/so I started running all the jpegs, no luck than I ran the png’s and bingo jf438r3PASSWORD940945345488

-Working on the animal track is hard but I think lion and maybe a bushbaby and ostrich.

-The password opened the locked file and opened up 20 or so pictures. So I went through them first reverse image searching

• personal photos,
  extraction photo1 Tianjin railway
  extraction 17 Tianjin west railway
  extraction 0 is the Tianjin south train
  extraction 5 TEDA Tianjin economic tech
  extract 25 39° 2’16.07″N 117°43’8.19″E
  found coal 3 39° 5’40.26″N 117°38’38.29″E\
  -extraction 10 old waiting building Tianjin west
  extraction 4 is Bawei bridge Shantou (maybe?)
  extraction 3 is Binhai international convention center

-I don’t know why but I searched Baidu for the phone number from Santou I first found and now magic a Jianquan Food Store, Jinping District, Shantou City — Aiqicha pops up so hopeful but is seems false Room 101 and 201, №92, Longyan Road, Jinping District, Shantou City

-emailed Oliver

“Hi Wendy,
no problem, the shipping id is
CN555701D10TWITT66
Kenya → China
25.03.2022 at 15:00 local time, ship Pangea

good health

Oliver”

-Randomly found pictures of pangolin tracks and the exact pictures are posted along with a lion track. I searched for pangolin tracks just because I knew that they were poached and ate in China due to some news stories about a kind of market and certain illness that if you mention you get banned everywhere. So I searched for “pangolin tracks”.

• Pangolin = Pholidota
  Four species live in Africa: Black-bellied pangolin (Phataginus tetradactyla), White-bellied pangolin (Phataginus tricuspis),
  Giant Ground pangolin (Smutsia gigantea) and Temminck’s Ground pangolin (Smutsia temminckii).

-The four species found in Asia: Indian pangolin (Manis crassicaudata), Philippine pangolin (Manis culionensis),
Sunda pangolin (Manis javanica) and the Chinese pangolin (Manis pentadactyla).

-Lion =Panthera leo

-There is only one species of lion, which is known scientifically as Panthera leo. There are two recognized subspecies,
the African lion P. l. leo and the Asiatic lion P.

• Now we look for the last piece of the puzzle, I think the market….. for hours and hours reviewing all the photos, photo data, documents, twitter and….nothing.
  – I went to bed woke up and kept banging head against wall untill an idea shakes loose. The old handler sure spent a lot of time around the west train station in Tianjin according to the personal photos lets see …
  look a cannel and some interesting land marks I noticed in the pictures that I haven’t seen anywhere else and boom turn the head side ways there it is..
  39°10’29.32″N 117° 8’16.61″E
• So I fill in the information, send it and wait, and then I get an email back close but there is only one type of animal, hmmm I know that 2 pictures were pangolins and I wasn’t 100% about the lion. So judging by the hunting ground location I determined it to be a ground pangolin. I was finally did it and was able solve this months CTF.

Hacktoria did one hell of a job, this challenge was so so frustrating at points and I felt like China and Russia were becoming concerned over the amount of searches done through Bandiu and Yandex.

I wanted to quit a lot of the time and then for no reason other than the randomness of the earth i would find something else and that kept me going. I think sometime Osint is like that a lot of time, but persistence pays off, and it pays off in badges.

Until next time

R3ap3rd0g