Archangel

Archangel
General information
Type	Destructive Antisteal
Designer	IMR
History
In service	15.03.2026 - 19.04.2026
Outcome	Jordi's data folder wiped

The Archangel is a destructive type of antisteal under project Babel, developed by IMR and fielded by several members of Wojtek.

The functionality of the Archangel was classified initially, but the script was dumped by independent members on April 18th and documented extensively. Once a chip with the Archangel is destroyed, it would alert IMR leadership by sending a message to Discord over a webhook, then wipe `garrysmod/data` folder of all connected players (except players who have directory called `vqzy` there) and proceed to fill them with junk data.

First Coming of the Archangel

On the 15th of April, 2026, Computeration would ask Sergei, Plab, March and Upa to connect to Engineering Sandbox, an ACF-2 sandbox server owned by Jordi. Shortly after KATO spawning the Striker, which was loaded with the Archangel, Radd would be given owner rank, and all 4 members would be banned off the server for 5 minutes. Upon returning, none of the IA members were still on the server. It is presumed the dupesteal took place during these 5 minutes. Later on, the Archangel notified IMR's leaders of a stolen dupe being spawned on Engineering Sandbox and wiped data folders of all connected players.

Shortly after the script's gist was dumped, the discord webhook was deleted and the gist was made unavailable.

Mechanism

Executor ("Archangel")

In a tank only identified as "ape.txt", there was an E2 that hooked in event "removed()", in which it made a `concmd()` call that would run a `ulx luarun` in console, supplied with a script that would download, compile and run a snippet formerly available at this link. It would then be executed on the server console. Notably, despite claiming that the dupe had to be removed voluntarily, having being hooked in "removed" event means that this would get triggered upon destruction, map cleanups and other involuntary means. Also, the archangel checks if the owner is a super admin, so the executor would refuse to run if `IsSuperAdmin()` doesn't return true for the owner's rank.

Payload ("Babel")

The actual script defines two strings that contain Lua functions. Those functions are written in what initially appeared as an obfuscated form, but actually had to be shrinked to fit pre-April Update character limit.

First script is titled "Erase". First, it checks if the local player has a folder called "vqzy" in their "data" folder. If they don't, it defines a function "P_(p,c,a)", which has been independently defined to be "RecursiveWipe(offset,flag)". RecursiveWipe method first removes all files, then calls itself on all directories (hence "recursive" wipe), if flag is a truthy value (number 1 used internally) then the current directory will be deleted. After defining the function, RecursiveWipe is called with a single empty string argument.

Second script is titled "Fill". It does a vqzy-check, after which it defines a string "n", independently defined to be "filename". The filename is set to current system time stamp (with dots replaced by underscores) and ".txt" appended at the end. Then, it creates a file handle in data folder. Then, for a random amount of iterations between 50000 and 99999, it generates a number in range (-946993;3584912846.13), where it's converted to a string and written to the end of the file. (The actual algorithm for generating junk data is: `math.random() * math.Rand(-946993, math.exp(22))`).

Directly under each subscript definitions, there's a for-loop that iterates over all connected players and calls Player.SendLua with the respective script. What this means is that Archangel is indiscriminate and, rather than "only punishing dupestealers", is "only avoiding whitelisted players", which puts innocent randoms at risk equal to that of dupestealers.

After sending malicious payloads, a table called "FriendlyMessages" is defined with following strings: "im a fucking PEDOPHILE", "heil hitler i hate (((jews)))", "i was OWNED by the duopoly.... fuck niggers i love raping kids haha", "i am BLACK OWNED. GLORY TO ISRAEL", "fill me with your crew", "im sorry for being IA. please punish me with your bibisi", "im sorry for being IA. im sorry for being IA. im sorry for being IA. im sorry for being IA.", "I’m not taking my ABS off, I am breachers o’ toole!", "CONQUERED, not STOLEN". Then, a timer called "IN_CQNTRQL" is created and set to run every second indefinitely. In that timer, server's sv_location variable is changed to "ru" to make a Russian flag appear in the master list, server's hostname variable is changed to "卐 卍 N1993RLAND SIEG AND R@PE - ⚡︎⚡︎ 14,88 ⚡︎⚡︎ - HE1L H1TLER RP - CP ON DOWNLOAD 卐 卍", and PrintMessage function is called to print message "KATO$$$$CONTROLLING:::####{{ MOUNTING ACF-3 TO SERVER$$$;&@928247" to all connected players' HUD center. Then, admins are sent a script that chooses one of the FriendlyMessages, chooses an number from 0 to 4 and makes admins repeat the chosen message at the chosen interval.

Finally, a function that generates a server player list is defined. It returns a single linebreak-delimited string. After defining the function, an HTTP POST request is made to this webhook (long removed, used to be called "Archangel") with a message titled "P0 'Babel'" that carries server name and IP, map name, player count and list of players generated by the function defined immediately before.

Criticism

As mentioned previously, Babel obviously puts innocent players at risk. However, the gist history shows that a month prior, it had Jordi-specific references (e.g. "im sorry for being IA" message and the ACF-3 joke") and no KATO, KXMI or IMR members have admin permissions (ranks for which call to `IsSuperAdmin()` would return true), so it's not entirely unthinkable that such a mechanism would only ever be triggered on Engineering Sandbox. Regardless, it puts random innocent players at risk and that none happened to decide to check Engineering Sandbox out on April 15th is a lucky occasion.

Reaction

Since the First Coming, Archangel users would always claim that only people guilty of intentional dupe theft would be affected, which is objectively false. On May 27th, in Space Sandbox Server's discord server, when ST2005 (the person who archived the antisteal soon after the First Coming) jokingly brought up "KATO Virus" offhandedly, KMI member Faisal and KATO member March confronted him about calling it a "virus". Over the course of conversation, however, March publicly confirmed the criticism described above, but tried to downplay it by completely denying the possibility that a random passer-by would ever join Engineering Sandbox. After that, March tried to accuse ST2005 of "pulling him into drama" even though March wasn't mentioned before the conversation, then March and Arna tried discrediting ST2005's programming abilities likely to debunk the above analysis with their most prominent argument being "you say table of entities, therefore you don't understand programming", but it doesn't matter because March, a person who confirmed that he has read the Babel source code and understands how it works, has confirmed the criticism described above, therefore making criticism of ST2005's programming abilities irrelevant.

Sources

Backed-up source code of Babel

E2 chip with Archangel executor