Operation ROLLINGVIPER

@Ciela I'm not onsite, just coordinating info as best I can.

 

Updates: Dispatch sent the following message to @acentes

nikel and Seshemw are onsite, Sesh is keeping lookout while nikel searches.

 

Paper found, pic to dispatch


FA Management, Inc.

Reimbursement for CC hack # 5298892 CH 42671
11/14/2016
$1100.00

 

Here's the pic that I was sent by nikel

 

email sent to myself and ground team.

 

Working on it. We have two, but I stuck with the phone to be unobtrusive so uploading it is irritating me. It was too big...

Missed the name. Apologies.
MOURAD ELAYACHI

And the number in the upper right is the check number.

Thank you for the relay.

Currently in an arbitrary place awaiting instructions. VPN with relocation is available, laptops currently unavailable for either agent present.

 

[10:10 AM] eliznik: Dispatch is having is go somewhere with Internet, I'm at Starbucks. Seshemw is on his way

 

Hmm... Elayachi is an Arabic name, there doesn't seem to be anyone famous with it that I could find with a Google search.

 

There's a cab driver with that name in New York and the number on the stub matches their licence number.

http://datagovus.com/new-york-hire-vehicle.php?id=5603763

Edit: Never mind, it doesn't seem to match. Someone on IRC said it did?

 

Someone should probably redact some of the info on that picture, then

 

I don't think any of it is vulnerable info..

 

I was going off the name and can number matching, but if they don't then no need.

 

Hey I'm pretty late to the party on this one, I'm workin' on the phase 2 puzzles at the moment but I don't see an input for answers on the COM-Division page, can someone point it out for me? I feel I'm probably overlooking something obvious

*EDIT* found it :3

 

@Zankh did you click on the 'lower image' on the far right side? it should give you a map with 4 nodes.
the first node gives you an archive number, with the docs you need to unlock the second node.
just click on the second node to input the answer there

 

One of the FA management Inc. entries seems rather suspicious. One like on Facebook followed by one person with no company info, and an Angie's list with no entries on it

 

Update:

 

Here we can write out passwords we've attempted.

https://docs.google.com/spreadsheets/d/1DlxJHt0v9LnlCIvgsfmAjeiPXR8PAe28zii5Xku8h9I/edit?usp=sharing

 

Got something.

https://www.linkedin.com/company/fa-management-services-inc

Could be a connection with the image.

 

We've got a breakthrough! Password was MOURADELAYACHI, which leads to an image with two sets of numbers/letters on it. The image is the same one on the Rhopagroup website. The letters/numbers are hex, and lead to this URL: bit.ly/2hctY5u

 

Bruteforced our way through the PDF, internal is this: