NITE Team 4 recently identified Maria Sagastume as DelicateDrive, a Black Hat responsible many recent attacks against the American Banking system. Agent you are to help our recruitment team by giving the intel requested. Sagastume is a high value asset and this mission is time sensitive, get to work Agent.

This Open World Operation contains 3 missions, each with multiple parts.

This guide is meant to be used as a resource and will contain hints in order to help you solve the missions, but it will not contain the actual answers.

If at any time you feel like you need more help please go to either the discussion board or the Discord channel[discord.gg] and there will be fellow agents happy to help you.

The missions and parts are the following:

1. A.018 - October 2018 - Part One
   
   • A.018 - Part One : Phase 1
     
   • A.018 - Part One : Phase 2
     
   • A.018 - Part One : Phase 3
2. A.018 - October 2018 - Part Two
   
   • A.018 - Part Two : Phase 1
     
   • A.018 - Part Two : Phase 2
     
   • A.018 - Part Two : Phase 3
3. A.018 - October 2018 - Part Three
   
   • A.018 - Part Three : Phase 1
     
   • A.018 - Part Three : Phase 2
     
   • A.018 - Part Three : Phase 3

NITE Team 4 recently identified Maria Sagastume as DelicateDrive, a Black Hat responsible many recent attacks against the American Banking system. Ascertain her current status and location, and our recruitment team will determine how best to proceed.
Remember to read the briefing document,[media.niteteam4.com] it may contain useful information.

• Hint 1 – Briefing mentions an archive number, you can use it here.[archive.blackwatchmen.com]
  
  
• Hint 2 – Make sure to read the document.
  
  
• Hint 3 – There is a mac address and a vendor, what module uses those two bits of information?

• Hint 1 – Make sure to dig thoroughly through his phone.
  
  
• Hint 2 – Maybe in the messages he mentioned something that could help you.
  
  
• Hint 3 – He mentions a city and visitations periods, I wonder if that can help narrow down the location.
  
  
• Hint 4 – Look at the city's wikipedia page, under economy.

It appears ICE apprehended Maria Sagastume on a routine immigrant sweep of the Phoenix area. They are likely unaware of her criminal activity, however, it is only a matter of time until the US intelligence community learns of Sagastume’s incarceration and realize they have the notorious DelicateDrive in custody.
Remember to read the briefing document,[media.niteteam4.com] it may contain useful information, and be sure to click the maltego nt4 entities in the support tab.

• Hint 1 – Briefing mentions communications between two people, what module can gather intel on people?
  
  
• Hint 2 – Mr Sagastume must have talked about Maria to his attorney.
  
  
• Hint 3 – Maybe XKeyscore can help.

• Hint 1 – The briefing mentions a domain.
  
  
• Hint 2 – Some people are oblivous to what they receive in their email.
  
  
• Hint 3 – They're currently hiring maybe they'll fall for a false CV application.
  
  
• Hint 4 – After you're inside the network make sure to have a look around for subdomains, maybe you can find a registry.
  
  
• Hint 5 – You'll need to use your heads to figure out how to use their registry.
  
  
• Hint 6 – You already have her ARN number from the document, now you just need to use it.

• Hint 1 – Where can you get an active directory from?
  
  
• Hint 2 – Maybe it's on the current computer, you just need to find the target path with a scan.
  
  
• Hint 3 – Where is she being held?
  
  
• Hint 4 – The active directories are city specific.
  
  
• Hint 5 -- All the info you need to find the correct file is in her registry database.
  
  
• Hint 6 -- After you upload the expedite order check her registry maybe something new has appeared.

NITE Team 4’s Off-Net Intrusion Group (ONIGRU) 15 was set to receive Maria Sagastume on Oct 18 at La Aurora International Airport (GUA) in Guatemala City. However, it appears a third party contacted Guatemalan authorities and outbid us. Sagastume is now being held by the Guatemalan Armed Forces, who will transfer her to the other party at any moment.
Remember to read the briefing document,[http//tbd] it may contain useful information, and be sure to click the maltego nt4 entities in the support tab.

• Hint 1 – Briefing mentions a deportation document, what module can gather intel on people and organizations?
  
  
• Hint 2 – The maltego nt4 entities gave you a person and two organizations, maybe they are connected.
  
  
• Hint 3 – Since she is being deported, maybe it's considered a shipping transaction.
  
  
• Hint 4 -- In the briefing there was an archive number, you can use it here,[archive.blackwatchmen.com] maybe you can cross-reference the departure and a certain vehicle leaving.
  
  
• Hint 5 -- How much time does it take to get from the Phoenix-Mesa Airport (AZA) to Guatemala?
  
  
• Hint 6 -- You have a departure time, how long it takes to get there and a list of vehicles leaving. Now just cross-reference.

• Hint 1 – The briefing mentions coordinates maybe you can use those in the StingerOS.
  
  
• Hint 2 – You got a license plate from part one, now you need to track it.
  
  
• Hint 3 – You can scan for wireless signatures, maybe that will help.
  
  
• Hint 4 – There seem to be a lot of cell towers nearby, maybe you can find their domain and infiltrate their network.
  
  
• Hint 5 – Sfuzzer and Fingerprint might help you find the correct subdomain.
  
  
• Hint 6 – Now that you're inside their network, maybe you can use their celltowers to track the driver's phone.
  
  
• Hint 7 – You've gotten his phone, now look for key individuals or facilities you can use in XKeyscore.

• Hint 1 – You got XKeyscore entities from the phone, maybe try to find out who is the captain, there should be some indication in the phone.
  
  
• Hint 2 – Maybe if you try the Captain and the organization, you'll get something.
  
  
• Hint 3 – You got a new entity, maybe that person has had further contact with the Captain.
  
  
• Hint 4 – That email, it mentions a product being moved between two places, maybe it's illegal.
  
  
• Hint 5 -- You need to find a name of a key individual, maybe a simple online search can help you out.
  
  
• Hint 6 -- Remember Google is your friend here.
  
  
• Hint 7 -- The key individual was vice-president at the time of the accusations against the administration.