Threat Intelligence Analysis: Lespion — OSINT Investigation of an Insider Threat
Platform: CyberDefenders Challenge: Lespion Category: Threat Intelligence / OSINT Difficulty: Easy Tools: Google Maps, Google Image Search, CyberChef, GitHub Achievement: Proof of Completion
1. Executive Summary
Incident Type: Insider Threat / Credential Exposure / Cryptomining
Subject: Émilie Marseille (EMarseille99)
A corporate network was compromised and brought offline. Digital forensic responders identified a single internal user account as the primary suspect. This challenge required a full OSINT investigation: identifying the insider by tracing their online alias, recovering plaintext credentials from a public GitHub repository, locating their physical workplace and personal travel history through image geolocation, and identifying the cryptominer they deployed on corporate infrastructure.
Indicators of Compromise (IOCs)
| Type | Indicator | Description |
|---|---|---|
| GitHub Username | EMarseille99 | Primary alias, starting pivot point |
| Real Name | Émilie Marseille | Identified via social media cross-referencing |
| Instagram Handle | @emarseille99 | Personal Instagram account |
| Employer | Software Consultants Inc. | Identified via office.jpg geolocation |
| Exposed API Key | aJFRaLHjMXvYZgLPwiJkroYLGRkNBW | Hardcoded in GitHub Login Page.js |
| Encoded Password | UGljYXNzb0JhZ3VldHRlOTk= | Base64 password found in GitHub repository |
| Decoded Password | PicassoBaguette99 | CyberChef Base64 decode result |
| Cryptominer | XMRig | Forked repository found on GitHub profile |
| Office Location | Birmingham, UK | Google Lens identification of office.jpg |
| Webcam Location | Indiana, USA | University of Notre Dame via WebCam.png |
MITRE ATT&CK Mapping Overview
| Tactic | Technique | ID |
|---|---|---|
| Credential Access | Credentials in Code (GitHub public repo) | T1552.001 |
| Discovery | Social Media OSINT | T1592 |
| Discovery | Image Geolocation (GEOINT) | T1591 |
| Collection | Data from Public Sources | T1213 |
| Impact | Resource Hijacking — XMRig Cryptominer | T1496 |
2. Phase 1: Initial Triage — Artifact Overview (Introduction)
Objective: Understand what artifacts have been provided and establish the investigation starting point.
The lab archive contains three key files that serve as the starting points for different investigative threads:
Github.txt— A URL:https://github.com/EMarseille99— the primary alias pivotoffice.jpg— A street-level photograph for geolocation (physical workplace)WebCam.png— A live webcam feed screenshot for geolocation (second location)
3. Phase 2: GitHub Credential Leak (Questions 1–4)
Objective: Investigate the GitHub profile to identify the subject’s real name, programming language used, and extract any exposed credentials.
Navigating to https://github.com/EMarseille99 reveals a public GitHub profile. A repository named Project-Build---Custom-Login-Page immediately stands out. Opening the repository and reviewing Login Page.js exposes two critical secrets embedded directly in the source code:
The file extension (.js) confirms the project’s frontend language as JavaScript. Using CyberChef’s From Base64 recipe to decode the embedded string UGljYXNzb0JhZ3VldHRlOTk= immediately returns the cleartext password:
Analyst Note: Base64 is not encryption — it is encoding. A credential “hidden” in Base64 provides zero security. Secret scanning tools (GitHub Advanced Security, Gitleaks, TruffleHog) must be integrated into every CI/CD pipeline to catch these exposures before code reaches a public repository.
Answer Q1
What is the real name of the threat actor?
Émilie Marseille
Answer Q2
What is the programming language used in the login page project?
JavaScript
Answer Q3
What is the API key found in the repository?
aJFRaLHjMXvYZgLPwiJkroYLGRkNBW
Answer Q4
What is the plaintext password recovered from the repository?
PicassoBaguette99
4. Phase 3: Cryptominer Discovery (Question 5)
Objective: Identify the cryptomining tool found on the subject’s GitHub profile.
Scrolling through the full GitHub profile reveals more than just the login page repository. A public fork of a well-known open-source project appears:
XMRig is the most widely deployed Monero (XMR) CPU miner in the threat landscape. It is used both by legitimate miners and by malware authors who bundle it into cryptojacking campaigns. Finding a fork of this repository on a corporate suspect’s profile strongly corroborates the network anomalies that triggered the investigation.
Answer Q5
What cryptomining software is found on the threat actor’s GitHub?
XMRig
5. Phase 4: Social Media OSINT — Cross-Platform Correlation (Questions 6 & 7)
Objective: Correlate the GitHub alias across social media platforms and use Instagram posts for geolocation intelligence.
A Google search for the username EMarseille99 surfaces accounts across Instagram, GitHub, and Steam — all confirmed as the same individual through profile photo matching and consistent naming conventions.
The Instagram profile (@emarseille99) contains travel photographs. Two posts provide geographic intelligence:
Answer Q6
What city is the suspect currently in based on their Instagram?
Singapore
Answer Q7
What city was the suspect previously in based on their Instagram?
Dubai
6. Phase 5: GEOINT — Office & Webcam Locations (Questions 8 & 9)
Objective: Use Google Image Search / Lens to geolocate the office.jpg and WebCam.png artifacts.
Office Location
The office.jpg photograph shows directional street signage referencing the Bull Ring shopping centre, the Hippodrome Theatre, and an ODEON cinema — distinctive landmarks of the Birmingham New Street area.
Webcam Location
The WebCam.png image shows a live EarthCam feed titled “A View from the Dome” overlooking a distinctive university campus with a prominent basilica.
Analyst Note: Image geolocation (GEOINT) is a legitimate and powerful forensic discipline. Architectural styles, street signage, skyline features, and identifiable landmarks can precisely locate a subject. Tools like Google Image Search, Google Lens, and Yandex Images are the primary resources for this technique.
Answer Q8
What city is the suspect’s office located in?
Birmingham
Answer Q9
What is the state in which the webcam is located?
Indiana
7. Conclusion
The Lespion investigation demonstrates how a single GitHub username — paired with systematic OSINT tradecraft — can build a comprehensive threat profile of an insider. Key findings:
- Initial Pivot:
Github.txtprovided the aliasEMarseille99→ Full name, social media, and credential exposure discovered within the same repository. - Credential Exposure: API key and Base64-encoded password (
PicassoBaguette99) committed to a public GitHub repository. - Cryptominer: XMRig fork on the suspect’s GitHub confirms motive for the network anomalies.
- Geolocation:
office.jpg→ Birmingham, UK;WebCam.png→ Indiana, USA; Instagram → Singapore and Dubai. - Platform Correlation:
EMarseille99alias confirmed across GitHub, Instagram, and Steam.
Key Takeaways for the SOC:
- GitHub is a treasure trove for threat intelligence — both for defenders hunting exposed secrets and for investigators building insider threat profiles. Implement automated secret scanning on all company repositories.
- Username correlation across platforms can quickly build a complete person profile from a single alias. Tools like Sherlock automate this cross-platform search.
- Image geolocation is a forensic discipline — don’t overlook the intelligence value of photographs. Metadata, landmarks, and architectural context can provide precise location intelligence.
- Cryptomining is often the first detectable signal of an insider threat monetizing their privileged network access. Monitor for anomalous CPU load patterns and outbound connections to mining pool endpoints.
Analysis Date: April 18, 2026 Analyst: El OMARI Zakaria