← All writeups

Operation Echo

May 2026 · OSINT UK CTF · 5 challenges

The Artifact (5pts)

Analysts, We have successfully decrypted the root folder of the hard drive seized from Asset Echo prior to his disappearance in September 2017.

The drive contained a single image file titled meet_loc.jpg.

Intelligence indicates that Echo used this specific image to communicate a meeting point to his handler. However, standard geolocation attempts have been inconclusive so far. We suspect this is not a simple photograph; Echo was known for altering images within his communications to avoid detection.

Perform a full analysis of the attached file. We need to know exactly where Echo was heading. Everything you need to find the location is contained within this file. All we know so far is that the location was a hotel in London.

You need to find the specific hotel that Echo went to.

Answer Format: - Use the osintuk{answer} format.

  • Use underscores instead of spaces.

e.g. osintuk{travelodge_finsbury_park}

The image presented seems suspiciously dark. Taking it to any image editing software/website (Photoshop, Forensically and so on) and playing with the contrast and brightness reveals the hidden text underneath. I personally used Microsoft Powerpoint, which is surprisingly capable for basic image editing.

The three words underneath - ‘then.number.known’ - clearly fit the mould for What3words. Searching on the platform takes us to Cove - Cannon Street, The City. Applying the format in the example flag gives us the real one.

Flag: osintuk{Cove_Cannon_Street}

The Getaway (15 pts)

Excellent work! The location is confirmed:
Cove Cannon Street.

We know Echo arrived at this location in September 2017, but local CCTV from that day was wiped long ago. We must rely on open-source intelligence to reconstruct the scene.

Intel indicates Echo was extracted by a London black cab waiting directly outside the hotel entrance. To track the vehicle, we need its registration number.

Scour historical imagery from around the hotel from that specific timeframe (Sept 2017). We believe a civilian may have captured a visual of the vehicle. We can search any license plates identified to see if anything flags up in our databases.

Find the taxi and report back on the license plate.

Answer Format:

  • No spaces

e.g. osintuk{AB12CDE}

DISCLAIMER/UPDATE: The visual you need turns out to be taken from Aug 2016, but nonetheless it was UPLOADED in Sep 2017. If you find the visual and notice “Aug 2016”, don’t be discouraged.

15 points for a clue! Quite the incentive.

Searches around the hotel itself shows plenty of black cabs in the general vicinity, but none with obvious number plates that aren’t otherwise blurred out. Given the clue’s wording - waiting directly outside - I decided to try looking at imagery from within the hotel instead at the times listed within the challenge.

By clicking on the hotel itself, we’re able to look at Street View & 360-degree views taken from within the hotel.

Clicking through these reveals a walkthrough of the hotel lobby from a matching date - September 2017. Navigating near the door shows a black cab’s plate: GX57 CPK.

Flag: osintuk{GX57CPK}

The Odometer (5pts)

Target vehicle identified: GX57 CPK (London Black Cab).

Analysis confirms the driver is a known associate of Echo, retained to facilitate movements throughout late 2017.

We have seized personal maintenance logs from the driver’s residence which claim the vehicle was sitting idle during the weeks following the drop. We need to verify the veracity of these claims against official data.

Locate the officially recorded mileage for this vehicle from October 2017. We will cross-reference your findings against the seized logs to confirm the driver’s timeline.

Answer Format:

  • Numbers only
  • No spaces or punctuation

e.g. osintuk{123456}

Vehicle mileage is recorded during MOT checks in the UK - the results of which are publicly visible online free of charge on the Gov.UK website.

A search for the vehicle’s licence plate on the platform quickly finds the answer.

Flag: osintuk{249278}

The Key Source (10pts)

Agents,

Our cryptanalysis team has finally managed to bypass the encryption on the final folder of the ‘Echo’ drive.

Inside, they found a text file containing a string of scrambled characters and a set of instructions. It appears Echo used a manual encryption method to secure his final message, relying on a specific keyphrase to lock it.

The instructions point to a physical ‘Key Source’ that existed publicly at the time of his disappearance.

Key Source Intel:

Publication: Hackney Today
Date: 25 September 2017
Location: Page 8

Intelligence indicates the key is a ‘well-known phrase’ found on this page. We need you to identify this phrase so we can attempt to decrypt the message.

Find the publication and locate the phrase on page 8.

Answer Format:

  • Use underscores instead of spaces

e.g. osintuk{the_quick_brown_fox}

I started this challenge by looking for archives of Hackney Today, but sadly have to report that Hackney Today’s archive no longer exists. It appears that Hackney Council have updated their publicly-accessible archives since this challenge’s creation date. This serves as an important reminder for timeliness in investigations - and a warning to not expect permanence in the internet. The Wayback Machine can only go so far in mitigating that.

In its absence, I’d like to give credit to Uzayr Kader. His walkthrough, made when the archive was live, shows the Hackney Council’s website as maintaining open archived copies of Hackney Today by date. Page 8 of the copy from 25th September 2017 shows the following phrase: ‘what goes around comes around’.

Flag: osintuk{what_goes_around_comes_around}

The Final Transmission (10pts)

We have the key. Now we can proceed to the message itself.

Below is the ciphertext extracted from the file. We do not know which specific cipher algorithm Echo used, but we know it relies on the text-based key you identified in the previous step.

Intercepted Ciphertext: WZSXZQSEPICGVVGRMFGRK

Analyse the ciphertext. Determine the encryption method used. Use the key from Challenge 4 to decrypt the string and reveal Echo’s final status.

This is the end of the line, Agents. Good luck.

Answer Format:

  • The decrypted cleartext
  • No spaces

e.g. osintuk{MISSIONASUCCESS}

This clue is made somewhat trivial thanks to the dawn of AI. Giving Claude the ciphertext and the key (‘what goes around comes around’) leads to this being cracked in seconds.

Flag: osintuk{ASSETCOMPROMISEDABORT}