Post cover image
challenge description

September 7, 2026

CloudyHeist — Flagyard Forensics CTF Walkthrough

Goal: Porve the Breach & identify the exfiltration channel (AnyDesk) to get the flag.

By Slender-man

3 min read

Introduction:

In this writeup I walk through the forensic investigation of cloudyHeist, a disk-image CTF challenge. The scenario is serious: a healthcare organisation subject to HIPAA suspects a breach.

Did data leave this machine? If so, what data, by which channel, and when? No network logs, no PCAP, no EDR telemetry. Just the disk. Let's dig.

Phase 0 — Scout the profile

C:\Users\FlagYard\ is our sandbox. But almost every personal folder is empty:

Documents   (empty)
Downloads   (empty)
Desktop     (empty)
OneDrive    (empty)
Pictures    (empty)
Videos      (empty)
Music       (empty)
Contact     (empty)
Search      (empty)
Links       (empty)

An attacker who exfiltrates then deletes the source files is a very common pattern — "we destroy what we copied." So I don't trust the emptiness; I treat it as potential evidence of cleanup. The real dirt lives in AppData. Let's split it: Local, LocalLow, Roaming. The Roaming\AnyDesk directory practically waves at us.

Phase 1 — The smell of remote access: AnyDesk

After a few boring clicks i found myself in C\Users\FlagYard\AppData\Roaming\AnyDesk, where i saw something interesting:

None

But What's AnyDesk ?

AnyDesk is a popular remote-desktop/remote-access application. One user can connect to another machine over the internet and view its screen, control the mouse & keyboard, transfer files, and tunnel traffic. Legit tool for IT support, but in the hands of an attacker it's a RAT without the malware: full interactive access to a live system. When you find a remote-access tool on a clean image, three questions immediately follow:

  1. Was it installed silently?
  2. Were there incoming connections?
  3. Did anyone transfer files?

1. The install — not innocent

'ad.trace' (AnyDesk's own diagnostic log, not a wireshark capture file as windows detects it) gives us the install:

"C:\Users\FlagYard\AppData\Local\Temp\AnyDesk.exe"
  --install "C:\Program Files (x86)\AnyDesk" --start-with-win --silent

Process started at 2025–06–02. PID 6692. OS is Windows 11 (64 bit) AnyDesk v9.5.4 was installed on 2025–06–02 at 22:15:44, launched from the Temp directory, with — silent and — start-with-win.

2. Incoming connections — someone came in

From 'connection_trace.txt', we have a trace on two incoming sessions on the incident night, from AnyDesk client 1367727428 — a peer AnyDesk gives the friendly name IEUser.

Incoming    2025-06-02, 22:19    User           1367727428    1367727428
Incoming    2025-06-02, 23:15    User           1367727428    1367727428

'ad.trace' confirms each handshake:

Accept request from 1367727428 (via relay).
Incoming session request: IEUser (1367727428)

3. File transfers — the smoking gun

AnyDesk also keeps a 'file_transfer_trace.txt' :

File Manager  2025-06-02, 22:20  start   upload  'stage.zip'  (~0 B out of 230 B)
File Manager  2025-06-02, 22:20  finish  upload  'stage.zip'  (~230 B out of 230 B)
Clipboard     2025-06-02, 23:01  start   upload  'stage.zip'  (~0 B out of 230 B)
Clipboard     2025-06-02, 23:01  finish  upload  'stage.zip'  (~230 B out of 230 B)
File Manager  2025-06-02, 23:15  start   upload  'stage.zip'  (~0 B out of 230 B)
File Manager  2025-06-02, 23:15  finish  upload  'stage.zip'  (~230 B out of 230 B)

This is the money shot: a file named stage.zip was uploaded three times, twice via the File Manager, once handed over via the clipboard. NOTE: "Upload" from the victim's perspective means data leaving the machine.

And 'ad.trace' tells us exactly where the attacker pulled files from, at matching timestamps:

22:20:04  Preparing files in 'C:\Users\FlagYard\AppData\Local\Microsoft\Windows'
          Preparation of 2 files completed (io_ok)
23:15:23  Preparing files in 'C:\Users\FlagYard\AppData\Local\Microsoft\Windows\CloudStore'
          Preparation of 1 file completed (io_ok)

So the exfiltration source directory is narrowed to: C:\Users\FlagYard\AppData\Local\Microsoft\Windows\CloudStore

Definition — CloudStore:

A Windows component that caches cloud-synced and per-user settings machine-locally in a compact binary store. Exactly the kind of file a script (or a human) might grab thinking it's "settings/config", and in this CTF, it's the place where the loot was hidden.

Phase 2 — The smoking gun: CloudStore

Inside CloudStore there's a single file: 'data'. I decided to move forward with it, as a significant amount of evidence points toward it. And i moved to kali for this one.

None

Two things jump out from the hex dump:

  1. The file starts with 50 4B, "PK", the classic ZIP magic bytes. A real CloudStore data blob is a binary structure, not a ZIP archive, so this file is in disguise.
  2. Inside the archive listing, the first embedded filename (in the right-hand ASCII column) reads 'notes.txt' .

I renamed the file to 'data.zip' , and moved forward:

None

That verbosity tells us everything, i went to bake the XOR encoded flag in cyberchef:

None