# Upon the Throne

**Category:** Database

**Points:** 120

## Description

\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/upon_the_throne.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
\<sup>Created By: \<code>@syyntax\</code>\</sup>

Pull the threads together. Aurora's breach was not random: an insider clerk snooped a gubernatorial candidate's chart to build kompromat, and a diversion-flagged physician was coerced into faking the Veltrexa trial that would decide a drug's approval. Both insiders were being run by the same DEADFACE handler, whose codename was recovered in a compromised-account field (`handler_ref`) on each side of the house: the audit-system users and the EHR providers.

Many handler codenames appear across those two tables - around fifteen on each side, so there is no obvious one to guess - but only one appears in both `users` and `providers`: the single operative managing an insider on each side. Find that codename.

Use the provided MySQL shell.

Submit the codename as `deadface{CODENAME}`. Example: `deadface{JOKER-4}`.

[Access Database](https://aurora.dctf.io)

## Services

- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
- [https://aurora.dctf.io)](https://aurora.dctf.io))