Read the campaign introduction and supporting information at https://github.com/hackthebox/advent-of-the-relics
A phishing attack on a logistics company has led investigators to a private criminal forum. The crew behind it has been planning something big for months. Your job is to dig through their communications and uncover who they are, what they’re targeting, and how they plan to disappear.
The forum can be accessed at: https://advent-of-the-relics-forum.htb.blue
First, you will need to gain access to the forum using the password SnowBlackOut_2026!, which you found in your previous investigation, to unlock the intel inside.
The scenario portrayed in this challenge is entirely fictional and created solely for educational and entertainment purposes. Any resemblance to actual persons, living or dead, organizations, or real events is purely coincidental and unintentional. All characters, scenarios, and data presented are products of imagination.
A crew of five planned a New Year’s Eve supply-chain operation against a logistics company and coordinated it on a private forum, with a phishing campaign aimed at one employee as the way in. They stood up a C2 panel on a rented VPS in the Balkans, registered a beacon domain and brought the listeners up weeks ahead of the date. A fake exhibition backed by forged manifests covered the physical transport, with a shell company ready as a fallback story. One trigger word, scheduled to the second before midnight, was meant to activate every node at once, followed by a wipe script to destroy evidence. The members then planned to leave by sea, with emergency extraction coordinates and a hideout prepared in advance. The forum’s own data file contained all of it.
https://advent-of-the-relics-forum.htb.blue → fetch index.html, app.js and data.js with curl. There are no evidence filesvm sandbox and dump to forum.json; never run it in a browserthread title | date built from forum.json, used to jump to the right threadTimestamp note: Forum dates are shown without a timezone. Q7 wants
hh:mm:ssand Q13 wantsYYYY-MM-DD; take both as posted.
The forum is client-side: the password gate is a SHA-256 check, but every thread, profile and member record ships in data.js. Fetch index.html, app.js and data.js, then evaluate data.js in an isolated Node vm sandbox and dump it to forum.json. No password is needed for that, and no code from the page ever runs in a browser. The members list holds five distinct accounts, and every thread author maps back to one of them.
curl -s -O https://advent-of-the-relics-forum.htb.blue/data.js -O https://advent-of-the-relics-forum.htb.blue/app.jsnode dump.js data.js > forum.jsonjq -r '.members[].name' forum.jsonRead the member roles. One account carries the “Ops lead” role, and the threads back it up: that account sets the timing, approves changes and is the one ordering the evidence wipe. The other members take requests from it.
jq -r '.members[] | [.name, .role] | @tsv' forum.jsonProfiles only carry handles, so the real name came from a slip in a thread. In the Physical Logistics thread dated 22 December 2025, another member tells Driver_BUD to stay focused and addresses them by first name.
grep -i 'stay focused' site/all.txt forum.jsonTip: Search thread bodies for how members address each other. Handles are consistent, so first names only leak in unguarded replies.
Ledger’s posts include a personal aside about a pet. The cat is named in one of those asides.
grep -i 'the cat' forum.jsonThe Forged Manifests thread describes the exhibition used as the paper cover story for the transport. The answer is the exhibition’s name as written there.
grep -i 'exhibition' forum.jsonThe Vehicle Prep thread lists the truck by model year and model designation. The answer is the manufacturer and the model line, as the format mask suggests (one short word and a two-letter model).
grep -i -A3 'vehicle prep' site/all.txt forum.jsonThreads about the forged manifests and paperwork refer to the forger by location. The forger is named by city, so the answer is a location, not a person.
grep -i 'forger' forum.jsonLedger’s Contingency thread sets out a fallback story if the exhibition cover fails: a shell company. The answer is its full registered name including the legal suffix.
grep -i -A3 'contingency' site/all.txt forum.jsonSnowFox’s post of 14 November 2025 names the primary phishing target at CALE and gives the target’s corporate email address. The full name is read off that address and the surrounding thread.
grep -io '[a-z.]*@cale-corp.org' forum.json | sort -uThe C2 domain thread lists a primary domain for beacon check-ins and fallbacks beneath it. Take the one marked primary.
grep -i 'domain' forum.json | headGotcha: The thread also lists backup domains. Only the one labelled primary is the check-in domain.
The same infrastructure thread names the VPS provider and where the server is hosted. The city is in the provider line.
grep -i 'vps' forum.jsonA post at 23:50 on 12 November 2025 says the listeners are live. The answer is that post’s date.
grep -i 'listeners are live' forum.jsonThe scope thread, “Patient Zero”, names the operation in its title. The same codename is used across the other planning threads.
grep -i 'operation' site/all.txt | headThe Ops lead’s thread on the activation plan states that only one trigger word lights all nodes. It is a single word, matching the answer format, and it is repeated alongside the scheduled time in Q7.
grep -i 'trigger' forum.jsonThe same author as Q2 posted on 10 December 2025 that the trigger word fires at a specific second before midnight on 31 December. The answer is the time in that post, in hh:mm:ss.
grep -i -B1 -A1 'FROST' forum.json | grep -i 'at [0-9][0-9]:'The Server Wipe Protocols thread names the script that destroys evidence on the nodes. The format mask (____ _____.__) points to a name with an underscore and a short extension.
grep -io '[a-z_]*\.sh' forum.json | sort -uThe Exfiltration thread describes the escape by sea and names the vessel. It is a two-word name, matching the mask.
grep -i 'vessel' forum.jsonSame thread: the crew is told who to ask for on arrival, and that name is the captain.
grep -i 'ask for' forum.jsonThe extraction point is not given as coordinates. The post gives a what3words address (three dot-separated words), which has to be converted. The legacy mapapi.what3words.com convert endpoint answered without an API key; the result lands in Palaio Faliro, Athens, which fits an emergency pickup by boat. Reference: what3words API.
curl -s 'https://mapapi.what3words.com/api/convert-to-coordinates?words=twitchy.develop.hulk'Gotcha: The answer format looks like plain decimal coordinates, but the forum never states them. The three-word address has to be decoded first, and the
w3w.coandapi.what3words.comendpoints want a key or return 403.
The Staging South thread, posted by Driver_BUD on 12 April 2025, gives the farmhouse hideout as full-precision decimal coordinates. Copy them as posted, without rounding.
grep -i -A3 'staging south' site/all.txt forum.json| Phase | Action |
|---|---|
| Resource Development | Crew of five plans the operation on a private forum under the codename Winter Blackout |
| Resource Development | C2 panel hosted on a VPS in Kragujevac; beacon domain health-status-rs[.]com |
| Command and Control | Listeners go live on 2025-11-12 |
| Initial Access | Phishing aimed at Kamil Poltavez at CALE |
| Resource Development | Forged manifests from a Bucharest forger; Miracles of Winter exhibition as cover; Danube Event Solutions Ltd as fallback |
| Resource Development | Volvo FH truck prepared for transport |
| Impact | Trigger word FROST scheduled for 23:59:50 on New Year’s Eve |
| Defense Evasion | burn_cycle.sh to wipe evidence |
| Exfiltration | Escape by sea on the Adriatic Wind, captain Stavros; extraction and hideout coordinates prepared |
| Timestamp (as posted) | Event |
|---|---|
| 2025-04-12 | Driver_BUD posts the farmhouse hideout coordinates in the Staging South thread |
| 2025-11-12 23:50 | Listeners reported live |
| 2025-11-14 | SnowFox names the primary phishing target |
| 2025-12-10 | Curator sets the trigger word and its time |
| 2025-12-22 | SnowFox addresses Driver_BUD by first name in Physical Logistics |
| 2025-12-31 23:59:50 | Scheduled trigger time |
| Type | Value |
|---|---|
| Domain (C2 beacon) | health-status-rs[.]com |
| Email (phishing target) | kamil.poltavez@cale-corp[.]org |
| Script | burn_cycle.sh |
| Trigger word | FROST |
| what3words address | twitchy.develop.hulk |
| Coordinates (extraction) | 37.936489, 23.68644 |
| Coordinates (hideout) | 43.84947615369828, 20.92715775614975 |
| Technique | ID | Description |
|---|---|---|
| Phishing | T1566 | Campaign aimed at a named CALE employee |
| Acquire Infrastructure: Domains | T1583.001 | Dedicated beacon check-in domain |
| Acquire Infrastructure: Virtual Private Server | T1583.003 | C2 panel hosted on a rented VPS |
| Application Layer Protocol | T1071 | Beacon check-ins to the primary domain |
| Indicator Removal: File Deletion | T1070.004 | burn_cycle.sh evidence wipe |
Client-side password gates protect nothing. The forum checked a SHA-256 hash in the browser while shipping every thread in data.js. Anyone who fetches the file reads the whole forum, so a gate needs to be enforced server-side to count.
Operational slips outlast handles. The crew kept consistent usernames, but a single reply used a real first name and a what3words address hid the extraction point only until someone decoded it. Treat casual replies and encoded locations as intel, not noise.
Planning threads give detection windows. The C2 domain, the VPS location, the listener go-live date and the phishing target were all stated weeks before the trigger date. Blocking the domain and warning the named employee would have cut the chain at the first stage.
Wipe scripts and fixed trigger times are huntable. A coordinated activation at a stated second and a named evidence-destruction script give concrete hunt targets: a filename, a time and a shared trigger word across nodes.
The crew intended to hit every node at 23:59:50 on New Year’s Eve and vanish by sea, but their entire plan sat in one file served to anyone who visited the forum. The sharpest lesson is that their weakest control was the one they relied on most, a browser-side password check.