Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

Analyze the endpoint beacon record `beacon.log` and decode the covert channel hidden among decoy traffic. Base64-decode the target host's data in sequence order, undo the single-byte XOR, and reconstruct the flag.
Group beacons in beacon.log by destination host; most decode to status=... messages
Only one host returns meaningless bytes -- that is the covert channel
Base64-decode those beacons in seq order and XOR each byte with a one-byte key (brute-forceable) to get the flag