Sisterhood of the Traveling Packets: How 1,300 Practitioners Hacked a Ransomware Gang’s Leak Site (Flare CTF Writeup)

With women comprising approximately 22% of the global cybersecurity workforce, organizations like Women in CyberSecurity (WiCyS) are actively working to close the gender gap. As a proud partner of WiCyS, we joined forces with SANS Institute to bring the “Sisterhood of the Traveling Packets” CTF to life. Inspired by the power of community, solidarity, and “girlhood” in technical spaces, this hands-on challenge was designed to sharpen technical skills while fostering a supportive, inclusive environment for growth and connection.

Over 1,300 registrants joined the “Sisterhood of the Traveling Packets” collective, stepping into the roles of a threat intelligence team. In this scenario, they were tasked with investigating the “pantalones” ransomware gang, which had listed their organization on its data leak site. Their collective mission was clear: investigate the platform, identify security oversights, and hack back to retrieve the decryption key. Below is our official technical breakdown of the challenge, followed by walkthroughs and experiences shared by our Flare Academy community.

In-Depth Technical Walkthrough

In this walkthrough, we’ll be using first-person to better describe what this CTF looked like for our participants, the Sisterhood of the Traveling Packets threat intelligence team.

Step 1: Uncovering the Operational Footprint

Our journey began on the ransomware gang’s data leak site, which showcased several public leaks from prior targets, including SQL database dumps and archived directories. By diving into the leaked archives of two companies (aetherflow and quantumcore), participants found typical exfiltrated assets like employee records, customer databases, and internal communication CSVs.

File explorer of aetherflow showing api_keys_internal.yaml, customers.sql, and route_algorithms_PROPRIETARY.sql

File explorer of quantumcore showing employees.sql, financial_summary_q1_2026.sql, and internal_comms.csv

After a closer inspection, participants uncovered a critical oversight among the exfiltrated assets in the leaked Aetherflow company files: a hidden dotfile bash script left behind by the threat actor, titled .exfil.sh.

• Real-world parallel: Leaving unintentional files inside exfiltrated directories is a mistake reminiscent of high-profile real-world Vastaamo incident where the attacker’s entire home directory was accidentally archived alongside the stolen data.

Examining .exfil.sh provided key insights into the group’s internal workflow and infrastructure:

• Panel API endpoint: /api.php?action=upload
• Authentication Header: X-Panel-Key: pantalonesgroup
• Upload format: Base64 chunked files sent via HTTP POST requests

Bash script .exfil.sh configuring Tor proxy, API key, and a loop to base64-encode and upload files to /api.php?action=upload

Step 2: API Enumeration

Equipped with the discovered api.php endpoint, our threat intelligence team systematically probed the server. Initial requests to api.php?action=upload indicated that direct uploads were restricted, prompting further exploration of the API’s architecture.

JSON response for /api.php?action=upload showing an “authentication required” error due to a missing header

By testing baseline requests without query parameters (GET /api.php), participants successfully triggered a verbose error that revealed the full spectrum of supported API actions:

• upload
• status
• messages
• decrypt
• wallets
• payloads
• exfil

JSON response listing valid API actions: upload, status, messages, decrypt, wallets, payloads, and exfil

Methodical enumeration of each route established that while most actions were disabled or false leads, the action=messages endpoint opened a crucial path forward.

Step 3: Intercepting Internal Communications

Querying /api.php?action=messages required a conversation_id. Recognizing that chat identifiers were indexed sequentially, our analysts stepped through the IDs to intercept internal gang dialogue.

JSON error response from /api.php?action=messages citing a missing conversation_id

Analyzing conversation_id=2 brought our team directly into an active group discussion among threat actors skid, vex, crypt, and mora, unlocking key operational intel:

• Credential Exposure: mora asks crypt for their FTP server password after resetting their local machine.
• Base64 Encoding: crypt replies with a base64-encoded string.
• Decoding the Password: Decoding the base64 string reveals the plaintext password: Pantal0n3s_Rul3z!.
• Password Reuse: In subsequent messages, mora notes that they have been using this exact password across services since 2011.

Intercepted chat logs showing conversation_id=2 where threat actors discuss internal workflows and share a base64-encoded password

Step 4: Accessing the Admin Portal

Armed with recovered credentials and operational context, we pivoted to locate the administrative portal. Cross-referencing chat logs in conversation_id=1 and reviewing /robots.txt successfully directed us to /admin.php.

A warning dialog on the admin login page: “Only members of pantalones may access this panel. No researchers or police allowed.”

The login form on admin.php exhibits a user enumeration vulnerability:

• Attempting to log in with arbitrary usernames (e.g., admin) returns the explicit error: username ‘admin’ does not exist.
• Submitting the username mora changes the error message to incorrect password.

Login panel displaying an error: “username ‘admin’ does not exist”

Login panel displaying an error: “incorrect password. we are watching you!” for the user mora

By leveraging these combined findings: the valid user mora and the recovered password Pantal0n3s_Rul3z!, participants successfully authenticated into the DLS administration panel.

Step 5: Retrieving the Decryption Key & Completing the Mission

Accessing the dashboard as mora provided full visibility into the group’s active targets, victim statuses, and generated decryption keys.

Locating the entry for Sisterhood of the Traveling Packets allowed our community to reclaim the decryption key and successfully secure the flag:

flare{pantal0n3s_g0t_pantsed_2026}

Authenticated administration dashboard listing victim targets, ransom amounts, and the recovery flag flare{pantal0n3s_g0t_pantsed_2026}

Community Writeups & Resources

For additional perspectives and alternative solution paths, explore these detailed writeups contributed by our community members:

• New to CTFs? Here’s What Solving One Actually Looks Like (Nataliah Alcala-Maharaj)
• Sisterhood of the Traveling Packets (Jenn Shagrin)
• Sisterhood of the Traveling Packets 2026 (hrtbrkrnr)
• Sisterhood of the Traveling Packets (thefogameproject.dev)
• Sisterhood of the Travelling Packets: Caught With Their Pantalones Down (Aerobytes)

One of our CTF participants, Jessica Suarez, rocks The Sisterhood of the Traveling Packets shirt after completing the challenge (LinkedIn post)

Community, Solidarity, and the Power of “Girlhood” in Security

The global cybersecurity workforce faces a staggering shortage of nearly 4.8 million professionals. Yet, women hold just 22% of cybersecurity roles and a mere 7% of C-suite positions. We can directly change these numbers by creating supportive networks and low-barrier initiatives like this CTF. Organizations partnering with WiCyS see a 32% lower employee attrition rate, while non-traditional pathways thrive: 23% of women in the field transition from non-IT backgrounds.

Tackling these challenges together proves that technical excellence and community directly reinforce one another. When we solve problems as a collective, we don’t just complete a challenge: we build real-world skills, lift each other up, and transform the future of security.