← Back to archive
TLP : RED βˆ™βˆ™ active engagement RFIs derived from filed tearlines Updated 2026.05.23

Open RFIs

Each Request for Information below was derived from a source-protected tearline filed at this archive. New tearlines drop new RFIs.
0 / 16 resolved

An RFI in this archive is a collection requirement derived from a filed tearline. The tearline establishes context and source authority; the RFI states the question. Each RFI has a deterministic answer that you verify against a SHA-256 hash locally in your browser. No submissions are reported back to the archive.

If you want public credit when you resolve an RFI, send a note to ornithos <at> ornithos.report with the RFI identifier and your handle. Credited solvers will be acknowledged when a reveal page is published, which only happens once enough solves arrive to warrant one.

Hints are deliberately sparse. If an RFI feels impossible, read the tearline that derived it. The tearline series contains the source context that the RFI assumes.

Tier I β€” Entry novice
Ξ± The First Phrase
FC-001 pcap
feathercapture_001.pcap contains a sentence written in the source MAC addresses. What does it say?
Open the capture in Wireshark. List every source MAC in capture order. Look at the last byte of each.
Ξ² The Nonce
FC-001 pcap
Frame 12 of feathercapture_001.pcap is a partial WPA2 handshake. It contains a five-word phrase hidden in plain sight. What is it?
The EAPOL key nonce is 32 bytes. Most of it is null padding. Most of it.
Ξ΅ The Greeting
FC-001 FC-002 pattern
Four bytes appear in every APT-AVIAN frame. What are they, in hexadecimal?
Check the vendor-specific information element of any beacon. They're at the end. They also appear in MAC OUI prefixes.
Tier II β€” Cross-artifact intermediate
Ξ΄ The Founding Year
AD-001 json
One contact in aircraft.json broadcasts a deliberately invalid squawk code from a malformed altitude. What year is the altitude encoding?
A four-digit number that doubles as a year. Cross-reference the threat brief.
Ξ³ Three Landings
AD-001 geospatial hard
Three migration contacts in aircraft.json are bearing for undersea cable landings. Name all three landing locations (city names will do).
Open flockaware. Click each migration contact (look for the larger blue birds (callsigns starting with TA-KA, HU-MA, KA-RU)). A dashed bearing line will highlight, showing where the contact is heading. Toggle Submarine cables in the top bar to overlay landing sites. Identify where each bearing terminates.
ΞΆ The Listening Cable
FC-002 pcap requires Ξ± decoded
feathercapture_002.pcap contains a new sentence. What does it say in English?
Same method as Ξ±. Then run the romanization through the translator. Four content words.
Tier III β€” The Nests hard Β· observation-based

The threat brief mentions that APT-AVIAN achieves persistence through nesting, operators returning to specific perches at intervals. None of the published feeds label these sites. They must be derived from observation.

Approach: open aircraft.json. Find the contacts marked stationary (gs = 0) at low altitude (under ~50 ft) and squawking 7747. Group them by spatial proximity. The clusters are nests.

Solving Ξ·β‚€ may reveal further work.

Ξ·β‚€ Persistence anchors
AD-001 hard
How many distinct nest sites can be identified by clustering the stationary perched contacts in aircraft.json?
Look for low-altitude contacts with ground speed zero. Group them by approximate location. Count the clusters. One small integer.
η₁ Nest Ξ± β€” centroid
AD-001 hard
Compute the centroid of the northernmost cluster in the western hemisphere. Lat/lon in decimal degrees. Tolerance Β±0.01Β°.
Average the lat/lon of the contacts in the cluster. Round to two or four decimals. Both forms accepted.
Ξ·β‚‚ Nest Ξ² β€” centroid
AD-001 hard
Compute the centroid of the cluster in the eastern hemisphere, northern latitudes. Same format as η₁.
Once you have located it, also look up what is at those coordinates in the real world. The answer is informative.
η₃ Nest Ξ³ β€” centroid
AD-001 hard Β· last in chain
Compute the centroid of the cluster in the southern hemisphere. Same format.
The most remote of the three. When you find the coordinates, search them. What is actually there in the real world is worth knowing.
Tier IV β€” Endpoint Recognition hard Β· domain-specific

The tearline report (TEARLINE-2026-04) asserts that APT-AVIAN does not tap submarine cables directly. They harvest from terrestrial endpoints. feathercapture_003.pcap was collected at the perimeter of an unspecified European cable landing site and contains both operator chatter and, in one frame, an encapsulated payload that 802.11 dissectors cannot parse.

Recognizing what you cannot read is the puzzle. Hex-dump the suspicious frame's vendor IE contents and look for a six-byte signature near the start.

ΞΊ The third phrase
FC-003 pcap
feathercapture_003.pcap contains another sentence in the source MAC addresses. Decode it (English or Avianic accepted).
Same method as Ξ± and ΞΆ. This phrase is six words long. The longest yet.
ΞΈ The opaque payload
FC-003 hard domain knowledge
Frame 23 of FC-003 carries an encapsulated payload that Wireshark cannot decode natively. The first six bytes of that payload form the framing signature of a telecom transport protocol. Name the protocol.
Three identical bytes, then three more identical bytes. The pattern dates from the 1980s. Either you recognize it on sight, or you hex-search for it. Wireshark cannot read it. You cannot read it. That is the point.
ΞΉ The operators' statement
FC-003 requires ΞΊ decoded
Frames 36 through 44 of FC-003 each contain a WPA2 EAPOL key frame. The nonces, read in sequence, spell a sentence about how the operators relate to the cable. What is it? (A short fragment is accepted.)
Same approach as Ξ². Treat each nonce as ASCII. Read in frame order.
Tier V β€” Current operations ongoing Β· expanding

From this tier forward, challenges are derived from tearline reports rather than from the foundational chain. Each tearline arrives with 2–4 graded open tasks that test whether the analyst has read the source material carefully. Tasks are named T-NN.M where NN is the tearline number and M is the sequence.

Tasks here are comprehension: the answers are in the published documents. You are not expected to perform new decoding work to solve these. You are expected to read what the sources said.

Tearlines drop on an irregular cadence. Each brings new tasks. Solved tasks accumulate, but new ones keep arriving. The chain advances.

From TEARLINE-2026-04 Β· SOURCE A

T-04.1 Identify a handling marking
TL-04 comprehension
TEARLINE-2026-04 carries a classification bar with three handling controls. Name any one of the three.
Look at the top of the tearline. The bar is dark red, white text. Three controls separated by double-dots.
T-04.2 The collocation hypothesis
TL-04 comprehension
Source A asserts that APT-AVIAN nest sites are geographically collocated with another type of facility. What kind of facility?
"Targeting hypothesis" section, second numbered item. Two- or three-word answer; abbreviations accepted.
T-04.3 Where the harvest occurs (per Source A)
TL-04 comprehension
Source A asserts that APT-AVIAN does not tap optical fiber. According to this source, the harvest occurs elsewhere. Name the kind of site.
Analytic Judgment 1. The answer is bolded in the original. Note: Source B in TL-05 disagrees with this assessment. Both readings are credited.

From TEARLINE-2026-05 Β· SOURCE B

T-05.1 Identify the device
TL-05 comprehension
Source B describes a specific class of commodity hardware that APT-AVIAN installs inside landing-station cages. Name the device class.
Analytic Judgment 1 in TL-05. The phrase is bolded in the original. Several common variants accepted (acronyms, shortened forms).
T-05.2 Identify the forensic trace
TL-05 comprehension
Source B describes a specific kind of physical evidence consistently found near affected cages, used to attribute the activity to a specific operator subtype. What is the evidence?
Analytic Judgment 2. Single-word answer accepted, though specifying the species is also accepted.
T-05.3 Identify the recipient
TL-05 comprehension
Source B asserts the take, once tapped, is uploaded to a specific tier of APT-AVIAN's infrastructure that handles distributed decoding. Name that tier.
"What happens to the take" section. Name the flock or the channel; multiple forms accepted.

How to claim public credit

This page validates your answers locally. The archive doesn't see your submissions. If you want your handle attached to a solve, email ornithos <at> ornithos.report with your handle, the challenge identifier, and the answer you submitted. Credited solvers will be acknowledged when a reveal page is published, which only happens once enough solves arrive to warrant one.

Anonymous solvers are credited as "prefer anonymous". Either choice is respected.

If you solved something genuinely new that the archive does not yet list as a challenge, send that too. New challenges added quarterly. Outstanding solves get priority placement.