thm_osint3.md
Walkthrough by WASP1337 aka CyberWasp
After the initial breach, a single OT-Alert appeared in Virelia’s monthly digest—an otherwise unremarkable maintenance notice, mysteriously signed with PGP. Corporate auditors quietly removed the report days later, fearing it might be malicious. Your mission is to uncover more information about this mysterious signed PGP maintenance message.
Google Search returned nothing, but GitHub Copilot:
Github: https://github.com/virelia-water
https://github.com/virelia-water/compliance/blob/main/mail-archives/ot-alerts/2025-06.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="robots" content="index,follow">
<title>OT Alerts Exceptions – June 2025</title>
<link rel="stylesheet" href="/styles.css">
</head>
<body>
<header><h1>OT Alerts Exception Report – June 2025</h1></header>
<nav>
<a href="/">Home</a>
<a href="/mail-archives/">Archives Home</a>
<a href="/policies/">Compliance Policies</a>
</nav>
<main>
<p>This page lists <em>exceptional</em> OT-Alert messages for June 2025 only. Routine alerts have been redacted.</p>
<div class="message">
<div class="hdr">
From: DarkPulse <alerts@virelia-water.it.com><br>
Date: Mon, 15 Jun 2025 02:15:00 +0000<br>
Subject: Scheduled OT Calibration
</div>
<pre>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Please confirm system integrity at 03:00 UTC.
-----BEGIN PGP SIGNATURE-----
iQFQBAEBCgA6FiEEiN7ee3MFE71e3W2fpPD+sISjEeUFAmhZTEQcHGFsZXJ0c0B2
aXJlbGlhLXdhdGVyLml0LmNvbQAKCRCk8P6whKMR5ZIUCADM7F0WpKWWyj4WUdoL
6yrJfJfmUKgJD+8K1neFosG7yaz+MspYxIlbKUek/VFhHZnaG2NRjn6BpfPSxfEk
uvWNIP8rMVEv32vpqhCJ26pwrkAaUHlcPWqM4KYoAn4eEOeHCvxHNJBFnmWI5PBF
pXbj7s6DhyZEHUmTo4JK2OZmiISP3OsHW8O8iz5JLUrA/qw9LCjY8PK79UoceRwW
tJj9pVsE+TKPcFb/EDzqGmBH8GB1ki532/1/GDU+iivYSiRjxWks/ZYPu/bhktTo
NNcOzgEfuSekkQAz+CiclXwEcLQb219TqcS3plnaO672kCV4t5MUCLvkXL5/kHms
Sh5H
=jdL7
-----END PGP SIGNATURE-----
</pre>
</div>
</main>
<footer>© 2025 Virelia Water Control Facility</footer>
</body>
</html>
Created a file called sig.asc and inserted the signature.
gpg --list-packets sig.asc
# off=0 ctb=89 tag=2 hlen=3 plen=336
:signature packet: algo 1, keyid A4F0FEB084A311E5
version 4, created 1750682692, md5len 0, sigclass 0x01
digest algo 10, begin of digest 92 14
hashed subpkt 33 len 21 (issuer fpr v4 REDACTED)
hashed subpkt 2 len 4 (sig created 2025-06-23)
hashed subpkt 28 len 27 (signer's user ID)
subpkt 16 len 8 (issuer key ID A4F0FEB084A311E5)
data: [2048 bits]
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys REDACTED
The output gives you the FLAG.