Operation Salted Earth

LOCKOUT · LINUX · difficulty 3 · ~22 min · 13 steps

A live ransomware run is locking you out as fast as you log in. Race it.

Briefing

fs-vault-02 is being encrypted right now. You still have a root shell, but something logs you out seconds after you connect, and the encryptor is chewing through /srv as you read this. This is not a clean recovery — it is a race against an adversary who is still on the box. Move in the right order: buy yourself a stable session, stop the process destroying data, then unpick the lockout mechanism. Understand what you touch — the wrong kill in the wrong order costs you the shell.

Objectives

Return to the range lobby

THREAT FEED ▲ lateral movement via wmiexec up 18% ▲ new loader family 'GHOSTPULSE' staging via DLL search-order hijack ▲ prompt injection in support queues now routine ▲ cron persistence campaign targeting exposed SSH ▲ poisoned model weights on public hubs ▲ remember: trust nothing, hash everything ▲
operator@dojo:~$