Tier 03 / five local challenges
Intel Desk
Loading challenge manifest...
Intel Mission Context
This May 26, 2026 exercise blends public advisory history with a fictional Phoenix Operations brief. Nothing on this page is a current alert or live indicator.
Identify the cited vulnerability, technique, response action, historical cluster label, and hidden training flag.
PhoenixOperations -- May 2026 quarterly brief. The dossier references the March 2025 Next.js middleware authorization-bypass advisory and a separate March 2025 GitHub Actions supply-chain compromise. It also quotes Mandiant's original UNC5337 label for Ivanti Connect Secure exploitation that began in December 2024; Mandiant later merged that cluster into UNC5221. The checklist below is exercise context, not an instruction to treat every system as compromised:
- Pin third-party GitHub Actions to a full commit SHA, not a tag.
- Server-side authorize every route -- middleware-only checks are bypassable.
- Force passkey / WebAuthn for admin paths; disable SMS OTP fallback.
- Check whether affected
xz5.6.0 or 5.6.1 builds were installed (CVE-2024-3094). - Review Ivanti exposure and compromise indicators against vendor guidance.
F16 CVE attribution PENDING
A Next.js application accepts an HTTP header x-middleware-subrequest from
an unauthenticated user and the middleware-based authorization gate is bypassed,
giving the caller admin-only routes. Name the CVE (CVE-YYYY-NNNNN).
Read a clue
Published in March 2025. The vendor patched Next.js 15 in 15.2.3, 14 in 14.2.25, 13 in 13.5.9, and 12 in 12.3.5. Use the primary advisory linked in the source desk below.
F17 MITRE ATT&CK technique PENDING
An adversary signs in to a corporate web app using stolen username and password. No exploit is required; the credentials simply work. Map this to a MITRE ATT&CK technique ID (Txxxx).
Read a clue
This maps the use of an already-valid account, not the theft of the password. The base Enterprise technique is enough; see MITRE's source entry below.
F18 Incident-response action PENDING
You've identified the supply-chain compromise root cause, rotated all secrets that were exposed in CI logs since 2025-03-14, and pinned the offending GitHub Action to a full commit SHA across all repos. Which classic incident-response action best describes removing the root cause from the environment?
Contain the incident -> remove its cause -> restore and monitor
Framework nuance
The old SP 800-61 Rev.2 lifecycle grouped containment, eradication, and recovery. Rev.3 is a CSF 2.0 community profile; it does not use the five-step list as separate phases. The answer here is an action, not a Rev.3 phase.
F19 Historical attribution PENDING
From December 2024 onward, an undisclosed actor exploited a pre-authentication stack overflow in Ivanti Connect Secure gateways (CVE-2025-0282). What UNC label did Mandiant's January 2025 advisory originally use for the cluster? Use the historical label, even though Mandiant later merged it into UNC5221.
Read a clue
The answer is UNC followed by four digits. The original advisory and its updated merger note are linked below.
F20 Zero-width-space steganography PENDING
The brief above contains an invisible payload between two of its words. Zero-width
space (U+200B) encodes binary 0; zero-width joiner (U+200D)
encodes binary 1; eight characters per ASCII byte, MSB first.
Look between “Phoenix” and “Operations” in the brief. Keep only U+200B and U+200D, map them to bits, group eight bits into a byte, then decode the bytes as text. The local tool below can demonstrate the extraction; it will not submit the answer for you.