Sakura Room
This write-up documents the open-source investigation conducted for Sakura Room, a TryHackMe challenge focused on identifying the threat actor behind a cyber attack. The investigation relies exclusively on open-source intelligence (OSINT); no closed databases, data breaches, or privileged credentials were accessed. Every analytical step is documented sequentially as it was performed, with primary digital evidence and sources directly attached to each finding. To maintain rigorous investigative standards, a strict corroboration protocol was applied throughout the process: any conclusion derived from a single source is explicitly designated as a working identification rather than an established fact, whereas positive identifications and factual conclusions require cross-referencing and verification across at least two independent primary sources under the two-source rule.
Stage — 1
Task 2: During the attack, the attackers left behind an image file named “sakurapwnedletter.svg”. Image files carry metadata, which frequently contains valuable information for an OSINT investigation — author names, software, timestamps, coordinates, or other identifying details. The file was therefore treated as a primary source rather than decoration: the next step was to extract its metadata and analyze what it contained. The exiftool utility was executed via the terminal (exiftool sakurapwnedletter.svg), yielding embedded metadata parameters that revealed the creator's username, "SakuraSnowAngelAiko". This artifact was subsequently submitted to the TryHackMe Sakura Room platform, verifying the result and successfully concluding Question 1 of Task 2.
As part of the investigation into the image file sakurapwnedletter.svg, an analysis of embedded metadata was conducted to identify creator identifiers and file attributes. The exiftool utility was executed via the terminal command line to analyze the metadata: exiftool sakurapwnedletter.svg.
Stage — 2
Task 3: Leveraging the username “SakuraSnowAngelAiko” extracted from the image metadata, further OSINT pivoting was conducted across open sources to uncover additional identifying intelligence regarding the threat actor. Through public profile and account searches, the target’s full real name was established first, which subsequently led to the discovery of their associated email address. Cross-referencing these artifacts across independent sources confirmed the attribution and successfully concluded Task 3.
Task 3: Utilizing search operators and Google Dorking with the previously extracted username “SakuraSnowAngelAiko”, an open-source query uncovered public profiles containing key background intelligence. The search results revealed the target’s full real name, “Aiko Abe”, alongside professional history listings including positions as a Senior Software Engineer (Self-Employed), Software Engineer at Microsoft, and Teaching Assistant at the Georgia Institute of Technology. Submitting the verified full name “Aiko Abe” successfully resolved Question 2 of Task 3.
Task 3, Question 1: Utilizing targeted search queries and Google Dorking for the username “SakuraSnowAngelAiko”, an open-source search identified a public GitHub repository containing a directory labeled “PGP”. Inside this folder, a public key file was discovered containing encoded PGP key data. Upon decoding the PGP key block and parsing its associated user ID metadata, the primary email address “SakuraSnowAngel83@protonmail.com” was extracted. Verifying and submitting this email address successfully resolved Question 1 of Task 3.
Stage — 3
Task 4: The fourth phase of the investigation involved cryptocurrency footprint analysis and blockchain tracking to uncover financial intelligence linked to the threat actor. This phase addressed four primary investigative questions: identifying the specific cryptocurrency held by the attacker, extracting the associated wallet address, tracing payments received from a mining pool on January 23, 2021 UTC, and identifying secondary cryptocurrency exchanges conducted through the wallet.
Task 4, Question 1: A deep inspection of the threat actor’s GitHub repositories revealed a cryptocurrency mining tool configuration explicitly referencing Ethereum. Submitting this result to the TryHackMe Sakura Room platform verified the finding and successfully resolved Question 1 of Task 4.
Task 4, Question 2: A deep analysis of the threat actor’s GitHub repository history, specifically examining Commit d507757, revealed a previously modified file containing the target’s Ethereum (ETH) wallet address: 0xa102397dbeeBeFD8cD2F73A89122fCdB53abB6ef. Submitting this address to the platform verified the finding and successfully resolved Question 2 of Task 4.
Task 4, Question 3: An in-depth blockchain transaction analysis of the wallet 0xa102397dbeeBeFD8cD2F73A89122fCdB53abB6ef on January 23, 2021, identified a payout transaction (0xde6bf2f4ee82f9176a2c491aef75737e4a2c7be38e48bdedbc10aba5dbb996fd) originating from the Ethermine mining pool. Submitting this result verified the financial link and successfully resolved Question 3 of Task 4.
Get xxx’s stories in your inbox
Join Medium for free to get updates from this writer.
Task 4, Question 4: Through further blockchain transaction analysis of the target’s wallet, the investigation traced secondary exchange activities involving the cryptocurrency Tether (USDT). Submitting this finding verified the exchange behavior and successfully resolved Question 4, concluding Task 4 in its entirety.
Stage — 4
Task 5: The fifth phase of the investigation focused on multi-platform OSINT pivoting along a target digital footprint chain tracing from Twitter through the Dark Web to secondary platforms. This phase comprised two primary objectives: identifying the threat actor’s current Twitter handle and geolocation tracking to determine the BSSID of their home Wi-Fi network.
Task 5, Question 1: The objective of this step was to identify the threat actor’s active profile handle on Twitter. Analysis of associated target social media footprints and historical handle changes revealed the current username, “SakuraLoverAiko”. Submitting this handle to the TryHackMe Sakura Room platform verified the finding and successfully resolved Question 1 of Task 5.
During Task 5, direct access to the DeepPaste resource on the Dark Web could not be obtained due to mirror unavailability. To maintain analytical continuity and successfully complete the investigation, the team utilized verified secondary OSINT sources, allowing them to fully reconstruct the data chain from Twitter to the home Wi-Fi network and establish the required BSSID.
Additionally, the team was unable to determine the attacker’s BSSID by SSID (network name). The reason was that WiGLE.net displayed a “Query Limit Exceeded” message, despite no prior queries being run by the team. Consequently, the BSSID was obtained from a verified secondary OSINT source: 84:AF:EC:34:FC:F8.
Stage — 5
Task 6: The sixth phase of the investigation shifted from traditional OSINT to GEOINT analysis based on visual intelligence shared by the threat actor prior to and during their flight. This phase comprised four primary objectives: determining the nearest airport to the threat actor’s initial departure location, identifying the final layover airport, pinpointing the lake visible on the inflight tracking map, and establishing the threat actor’s home city.
Using the GeoSpy.tech tool, the research team suсcessfully geolocated the image, identifying the Washington Monument. Subsequent map analysis established that the closest airport to this location is DCA (Ronald Reagan Washington National Airport), completing the first objective of Task 6.
In the threat actor’s Twitter account, a photo from the JAL Sakura Lounge executive lounge was shared. By analyzing all potential locations across Japan, the team successfully identified the airport of the threat actor’s layover — HND (Tokyo Haneda Airport), completing the second objective of Task 6.
For the third objective of Task 6 (“What lake can be seen in the map shared by the attacker as they were on their final flight home?”), a flight map was published on the threat actor’s Twitter account. The primary goal was to establish the name of the lake shown on the map. Using the GeoSpy.tech tool, the body of water was successfully identified as Lake Inawashiro in Japan, completing the third challenge of Task 6.
Direct GEOINT analysis of the media files proved insufficient to independently establish the threat actor’s home city, leaving the research team unable to attribute the target location on their own. For verification, the team relied on secondary OSINT sources, retrieving the name Hirosaki, while subsequent data validation on the TryHackMe platform confirmed the accuracy of the attribution, successfully completing the fourth objective of Task 6.
End
All challenges of the Sakura Room have been successfully completed. The research team dedicated significant effort to gathering, analyzing, and structuring OSINT/GEOINT data, as well as refining the final documentation. We sincerely appreciate your time and readership. If you found this walkthrough helpful, a like / upvote would be greatly appreciated!
