Writeups/TryHackMe/Operation Slither - TryHackMe Writeup

TryHackMeEasyRoom

Operation Slither - TryHackMe Writeup

Operation Slither TryHackMe writeup — OSINT username correlation across X, Threads, Instagram, SoundCloud and GitHub to unmask three operators of Sneaky Viper.

2026-01-30

#TryHackMe #Operation Slither #OSINT #Username Enumeration #Social Media Intelligence #Base64

Follow the leads and find who's behind this operation.

Difficulty: Easy–Medium (OSINT)

Focus: Username reconnaissance, cross-platform correlation, metadata & content analysis

Each task reveals another operator through indirect associations and reused handles.

##🧩 Task 1 — The Leader

###🎯 Objective

Identify information related to the leader of Sneaky Viper using a leaked forum post.

###🔍 Initial Clue

Forum post excerpt:

Full user database TryTelecomMe on sale!!!
@v3n0mbyt3_

The only actionable data here is the username:

v3n0mbyt3_

###🔎 Recon Process

>
Username enumeration
- >
  We already know the user exists on Twitter/X:
  https://x.com/v3n0mbyt3_
  v3n0mbyt3_ profile on X
>
Key Tweet Discovered
```
Threads is more fun! Twitter out.
```
This strongly suggests activity on Threads.
>
Threads Profile
```
https://www.threads.net/@v3n0mbyt3_
```
v3n0mbyt3_ Threads profile
>
Replies Section Analysis
- >A reply contains a Base64-encoded string:
```
VEhNe3NsMXRoM3J5X3R3MzN0el80bmRfbDM0a3lfcjNwbDEzcyF9
```

###🔐 Decoding

Decoding the Base64 string reveals the flag:

THM{sl1th3ry_tw33tz_4nd_l34ky_r3pl13s!}

###✅ Answers

Question	Answer
Other platform used	`threads`
Flag	`THM{sl1th3ry_tw33tz_4nd_l34ky_r3pl13s!}`

##🧩 Task 2 — The Sidekick

###🎯 Objective

Identify the second operator communicating with v3n0mbyt3_.

###🔍 Lead From Task 1

From the Threads replies, another username appears:

_myst1cv1x3n_

###🔎 Recon Process

>
Threads Profile
```
https://www.threads.net/@_myst1cv1x3n_
```
myst1cv1x3n Threads profile

Minimal activity, but confirms the handle.
>
Instagram Enumeration
```
https://www.instagram.com/_myst1cv1x3n_/
```
myst1cv1x3n Instagram profile
>
Interesting Instagram Post
```
https://www.instagram.com/p/C6BuP1CNMCI/
```
Instagram post linking to SoundCloud
- >Contains a SoundCloud link in the description.
>
SoundCloud Profile
```
https://soundcloud.com/v1x3n-195859753
```

###🎵 Key Discovery

Track:

SoundCloud track prototype2

prototype2
https://soundcloud.com/v1x3n-195859753/prototype2

>The audio includes a conversation about executing the operation.
>The page description contains a Base64-encoded string, which is the flag.

SoundCloud track description containing the Base64 flag

###🔐 Flag

THM{s0cm1nt_00ps3c_f1ng3r_m1scl1ck}

###✅ Answers

Question	Answer
Second operator username	`_myst1cv1x3n_`
Flag	`THM{s0cm1nt_00ps3c_f1ng3r_m1scl1ck}`

##🧩 Task 3 — The Last Operator

###🎯 Objective

Identify the third operator and uncover infrastructure-related details.

###🔍 Pivot From Previous Task

While reviewing SoundCloud activity, we notice a fan account:

sh4d0wF4NG

Fan account sh4d0wF4NG on SoundCloud

###🔎 Recon Process

>
Platform Enumeration
- >
  GitHub profile found:
  https://github.com/sh4d0wF4NG
  sh4d0wF4NG GitHub profile
>
Repository Analysis
- >
  Only non-forked repository:
  red-team-infra
  red-team-infra repository

>

Commit History Inspection

>

Suspicious commit:

https://github.com/sh4d0wF4NG/red-team-infra/commit/78de1f17c45b994e97b8629aa7e5f42c31a0e7f7

###🔐 Embedded Secret

Within the commit:

json

"shadow-password": {
  "value": "VEhNe3NoNHJwX2Y0bmd6X2wzNGszZF9ibDAwZHlfcHd9",
  "type": "string"
}

###🔓 Decoding

Decoded flag:

THM{sh4rp_f4ngz_l34k3d_bl00dy_pw}

###✅ Answers

Question	Answer
Third operator handle	`sh4d0wF4NG`
Other platform used	`github`
Flag	`THM{sh4rp_f4ngz_l34k3d_bl00dy_pw}`