Network Forensics Playbook, Attribution, & Comparative Campaign Analysis

Multi-Document Package
Classification: Threat Intelligence / Forensics
Last Updated: September 2026

---

PART 1: NETWORK FORENSICS PLAYBOOK

PCAP Analysis Workflow

Step 1: PCAP Ingestion & Pre-Processing

bash
Copy
1# Verify PCAP integrity
2capinfos network_capture.pcap
3
4# Extract statistics
5tshark -r network_capture.pcap -q -z conv,ip
6
7# Filter for relevant traffic (C2, phishing downloads)
8tshark -r network_capture.pcap -w filtered.pcap \
9  'ip.dst == 185.220.101.45 || ip.dst == 193.45.67.89 || dns.qry.name contains "any.run"'

Step 2: DNS Resolution Analysis

Query Suspicious Domains:

bash
Copy
1# Extract all DNS queries
2tshark -r network_capture.pcap -Y 'dns.flags.response == 0' \
3  -T fields -e frame.time -e dns.qry.name -e ip.src
4
5# Sample output:
6# May 15, 2024 14:47:23  any.run              10.0.1.105
7# May 15, 2024 14:47:24  c2-control.xyz       10.0.1.105
8# May 15, 2024 14:47:25  185.220.101.45       10.0.1.105 (reverse lookup)

Correlate with Known Malicious Domains:

bash
Copy
1# Compare against threat intel feeds
2for domain in $(tshark -r network_capture.pcap -Y 'dns.flags.response == 0' \
3  -T fields -e dns.qry.name); do
4    curl -s "https://api.threatstream.com/api/v2/intelligence/?username=USER&api_key=KEY&type=domain&value=$domain"
5done

Step 3: HTTP Traffic Reconstruction

Extract HTTP Requests:

bash
Copy
1# List all HTTP requests
2tshark -r network_capture.pcap -Y 'http.request' \
3  -T fields -e frame.time -e http.request.method -e http.request.uri -e ip.src -e ip.dst
4
5# Sample output:
6# 14:47:23  GET    /tasks/a1b2c3d4e5f6/         10.0.1.105  1.2.3.4 (Any.Run)
7# 14:47:50  POST   /login                        10.0.1.105  tax-audit-check.ca
8# 14:48:05  GET    /download/report              10.0.1.105  cra-compliance-check.xyz

Extract HTTP Request Bodies (credential harvesting):

bash
Copy
1# Decode POST data
2tshark -r network_capture.pcap -Y 'http.request.method == "POST"' \
3  -T fields -e frame.time -e http.request.full_uri -e urlencoded-form.key -e urlencoded-form.value
4
5# Sample output (credentials sent to attacker):
6# 14:47:50  tax-audit-check.ca/login
7#   sin_number: 123-456-789
8#   password: EncryptionIsForWusses2024

Step 4: C2 Communication Pattern Analysis

Identify Beacons (repetitive outbound connections):

bash
Copy
1# Extract outbound connections to suspicious IPs
2tshark -r network_capture.pcap -Y 'ip.dst == 185.220.101.45 && tcp.dstport == 80' \
3  -T fields -e frame.time -e tcp.srcport -e tcp.dstport -e frame.len | sort
4
5# Pattern recognition:
6# 14:48:35  49323  80  1024 bytes (POST /api/register)
7# 14:53:35  49324  80  512 bytes  (POST /api/check)    ← Heartbeat (5 min interval)
8# 14:58:35  49325  80  512 bytes  (POST /api/check)    ← Heartbeat (5 min interval)
9# 15:03:35  49326  80  512 bytes  (POST /api/check)    ← Heartbeat (5 min interval)
10
11# Conclusion: Repeating beacon every 5 minutes = C2 activity

Extract C2 Payloads (encrypted):

bash
Copy
1# Follow TCP stream to view complete conversation
2# Wireshark: Right-click packet → Follow → TCP Stream
3
4# Output (encrypted JSON):
5# POST /api/register HTTP/1.1
6# Host: c2-control.xyz
7# Content-Type: application/json
8# Content-Length: 256
9# 
10# [binary encrypted payload]
11# 
12# HTTP/1.1 200 OK
13# Content-Type: application/json
14#
15# [binary encrypted response]

Step 5: File Transfer Detection

Identify Downloaded Payloads:

bash
Copy
1# Extract file downloads
2tshark -r network_capture.pcap -Y 'http.response.code == 200 && data.len > 100000' \
3  -T fields -e frame.time -e http.response_for.uri -e ip.src -e ip.dst
4
5# Sample output:
6# 14:48:05  /download/report                    10.0.1.105  cra-compliance-check.xyz
7# 14:48:15  /payloads/AnyDesk_6.2.exe           10.0.1.105  193.45.67.89 (2.8 MB file)

Extract & Hash File (for IOC generation):

bash
Copy
1# Use Wireshark to extract binary:
2# File → Export Objects → HTTP → Save file
3
4# Hash extracted file:
5md5sum AnyDesk_6.2.exe
6sha256sum AnyDesk_6.2.exe
7
8# Compare against known hashes:
9# MD5: f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6 (malware database hit)

Step 6: Lateral Movement Detection (If Available)

Monitor for RDP, SMB, Kerberos traffic:

bash
Copy
1# RDP connections (port 3389)
2tshark -r network_capture.pcap -Y 'tcp.dstport == 3389' \
3  -T fields -e frame.time -e ip.src -e ip.dst -e tcp.dstport
4
5# SMB connections (port 445)
6tshark -r network_capture.pcap -Y 'tcp.dstport == 445' \
7  -T fields -e frame.time -e ip.src -e ip.dst -e smb.cmd
8
9# Kerberos TGT requests (port 88)
10tshark -r network_capture.pcap -Y 'tcp.dstport == 88' \
11  -T fields -e frame.time -e ip.src -e ip.dst -e krb5.adtype

Step 7: Exfiltration Pattern Detection

Identify data egress (large outbound transfers):

bash
Copy
1# Outbound traffic by volume
2tshark -r network_capture.pcap -q -z ip_hosts,tree
3
4# Look for:
5# - Large outbound connections to attacker IPs
6# - Unusual protocols (DNS tunneling, HTTPS to suspicious IPs)
7# - Timing patterns (large transfers at night = potential exfiltration)

Automated Network Forensics Tools

Zeek (Bro IDS) Automation

text
Copy
1# Script: detect_c2_beacons.zeek
2# Detects repetitive beacon patterns
3
4@load base/protocols/http
5@load base/protocols/ssl
6
7module BeaconDetection;
8
9const beacon_hosts = set(
10    "185.220.101.45",
11    "193.45.67.89"
12);
13
14export {
15    redef enum Notice::Type += { BeaconDetection::PotentialBeacon };
16}
17
18global beacon_intervals: table[conn_id] of vector of double = table();
19
20event http_request(c: connection, method: string, uri: string,
21                   version: string, headers: http_header_table, 
22                   body: string) &priority=5 {
23    
24    if (c$id$resp_h !in beacon_hosts) return;
25    if (method != "POST" || !/api\/(register|check)/ in uri) return;
26    
27    local cid = c$id;
28    local timestamp = network_time();
29    
30    if (cid !in beacon_intervals) {
31        beacon_intervals[cid] = vector(timestamp);
32    } else {
33        beacon_intervals[cid] += timestamp;
34    }
35    
36    # Check for regular intervals (within 10% variance)
37    if (|beacon_intervals[cid]| >= 3) {
38        local intervals: vector of double = vector();
39        for (i in [1..|beacon_intervals[cid]|-1]) {
40            intervals += beacon_intervals[cid][i+1] - beacon_intervals[cid][i];
41        }
42        
43        # Calculate mean and variance
44        local mean = 0.0;
45        for (interval in intervals) mean += interval;
46        mean /= |intervals|;
47        
48        # If mean ~= 300 seconds (5 min beacon), alert
49        if (mean > 250 && mean < 350) {
50            NOTICE([$note=BeaconDetection::PotentialBeacon,
51                    $conn=c,
52                    $msg=fmt("Regular C2 beacon detected: ~%.0f sec interval", mean)]);
53        }
54    }
55}

Suricata IDS Rules

text
Copy
1# rule: c2_beacon_detection.rules
2
3# Alert on C2 domain POST requests
4alert http $HOME_NET any -> $EXTERNAL_NET any (
5    msg:"Possible C2 Beacon - POST to /api/register";
6    flow:established,to_server;
7    content:"POST"; http_method;
8    content:"/api/register"; http_uri;
9    content:"application/json"; http_header;
10    classtype:trojan-activity;
11    sid:1000001;
12    rev:1;
13)
14
15# Alert on Any.Run suspicious access
16alert http $HOME_NET any -> $EXTERNAL_NET 443 (
17    msg:"Suspicious Any.Run Analysis Access (potential phishing)";
18    flow:established,to_server;
19    content:"Host|3a|"; http_header;
20    content:"any.run"; http_header;
21    content:"/tasks/"; http_uri;
22    classtype:suspicious-activity;
23    sid:1000002;
24    rev:1;
25)
26
27# Alert on executable download with CRA filename
28alert http $HOME_NET any -> $EXTERNAL_NET any (
29    msg:"Malware Download - CRA Themed Executable";
30    flow:established,to_server;
31    http.response_body;
32    content:"CRA_"; nocase;
33    content:".exe|3b|"; nocase;
34    classtype:trojan-activity;
35    sid:1000003;
36    rev:1;
37)

---

PART 2: ATTRIBUTION DEEP DIVE

Victimology & Target Selection

Primary Targets:

• Canadian tax preparers & accountants
• UAE businesses (multinationals)
• SMBs with limited security budgets
• Remote-first organizations (RMM tool adoption)

Selection Methodology:

• LinkedIn scraping (public profiles of tax professionals)
• Business registry searches (company names + accountant)
• Email harvesting from business directories
• OSINT on target organizations

Infrastructure Attribution

IP Geolocation Analysis

IP	ASN	Provider	Country	Confidence
185.220.101.45	AS206485	AlterHost Ltd.	UAE	High
193.45.67.89	AS16509	Amazon Web Services	USA (Virginia)	High
109.234.45.123	AS39798	QuotaGuard	Netherlands	Medium

Analysis:

• UAE ISP (AS206485) suggests operator presence in UAE
• AWS usage (common for bulletproof hosting)
• Geolocation may be spoofed/VPN'd

Domain Registration Attribution

Domain Timeline:
─────────────────
Feb 2024   - c2-control.xyz registered (NameCheap, privacy enabled)
Mar 2024   - tax-audit-check.ca registered (also NameCheap)
Apr 2024   - cra-compliance-check.xyz registered
May 2024   - Campaign launch

Registrant Pattern:
  - Always uses NameCheap (registrar choice)
  - Always enables WHOIS privacy
  - Always pays multi-year (cost hiding)
  - Quick domain rotation (5-10 domains created monthly)

Attribution Hypothesis:

• Organized threat actor (group, not individual)
• Financial resources (paid hosting, privacy services)
• Targeting specific geographic regions (CRA, UAE targets)

Tactical Attribution

Malware Similarities to Known Groups:

Technique	AnyTax Campaign	Similar Group	Confidence
.NET Reactor packing	Yes	FIN7, Fin8	Medium
XOR encryption	Yes	Carbanak, Lazarus	Low (too common)
CRA impersonation	Yes	Unknown	High (custom)
Any.Run abuse	Yes	Unknown	High (novel)
RMM tool deployment	Yes	Wizard Spider, Evil Corp	High

Conclusion: Likely affiliated with or copying Wizard Spider / Carbanak TTPs, but with unique CRA-focused lures.

Language & Cultural Clues

Error Messages (English):
  "Installation failed. Please try again."
  "AV detection. Aborting."
  → Native or fluent English speaker

Code Comments:
  [None visible in binary - professional development]

Variable Naming:
  - camelCase convention (common in English-speaking teams)
  - No Cyrillic/Chinese characters
  - No obvious translation artifacts

Operational Hours:
  - 14:00-18:00 UTC (consistent)
  → Could indicate UAE (UTC+4) business hours or spoofed

Ransom Demand (if applicable):
  - Professional format
  - Polished Bitcoin payment infrastructure
  - English + French included (Canadian targeting)

Financial Attribution

Campaign Economics:

Investment:
  - Domain registration: ~$100
  - C2 hosting: ~$50/month
  - Code signing certificate: ~$500 (stolen/fraudulent)
  - Testing/infrastructure: ~$500
  Total: ~$1,200-2,000 for campaign setup

Revenue (estimated):
  - If 500 organizations compromised
  - 10% hit rate for ransomware = 50 organizations
  - Average ransom $50,000 = $2.5M
  - Real collection rate ~30% = $750,000
  
Profit Margin: ~400x ROI (after operational costs)
→ Indicates well-funded, professional organization

---

PART 3: COMPARATIVE CAMPAIGN ANALYSIS

Similar RMM-Based Campaigns

Campaign 1: Wizard Spider / Trickbot (2019-2024)

Similarities:

• Uses RMM tools (ConnectWise ScreenConnect, AnyDesk)
• Multi-stage attack (reconnaissance → RMM → ransomware)
• Targets organizations with valuable data
• Uses living-off-the-land techniques

Differences:

• Trickbot uses banking malware (not just reconnaissance)
• No government spoofing (financial institutions instead)
• More sophisticated C2 infrastructure
• Uses credential harvesting at scale

Campaign 2: Evil Corp / Doppelpaymer (2019-2023)

Similarities:

• RMM tool abuse for lateral movement
• Ransomware payload deployment
• Network reconnaissance phases
• Organized group structure

Differences:

• Targets large enterprises (not SMBs)
• No phishing component (worm-based initially)
• More sophisticated malware (Doppelpaymer ransomware)
• Larger ransom demands ($3M+)

Campaign 3: Carbanak / FIN7 (2013-2024)

Similarities:

• Multi-stage payload delivery
• Financial motivation (ransomware)
• Professional development practices
• Persistent C2 infrastructure

Differences:

• Historically targeted financial institutions
• Used spear-phishing + zero-days
• More advanced evasion techniques
• Larger victim pool historically

Unique Aspects of Operation AnyTax

1. CRA/Tax Authority Impersonation - Not seen in other campaigns to this scale
2. Any.Run Abuse - Novel use of legitimate malware sandbox for evasion
3. Geographic Focus - Specific targeting of CRA and UAE entities
4. RMM Tool Flexibility - Deploys AnyDesk, ConnectWise, or TeamViewer based on reconnaissance

Campaign Evolution Timeline

Historical RMM Campaigns:
─────────────────────────
2014: Widespread RMM tool abuse begins (Ponemon Institute report)
2019: Wizard Spider systematizes RMM deployments
2020-2021: Any-Run gains popularity as malware analysis platform
2022: Attackers begin abusing Any.Run for evasion
2024: Operation AnyTax combines elements (CRA phishing + Any.Run + RMM)
2026: Campaign still active with refinements

Innovation Ladder:
  Stage 1 (2014): "If they have RMM tool, we have access"
  Stage 2 (2019): "Deploy RMM tool after initial compromise"
  Stage 3 (2022): "Use Any.Run to host malware & evade detection"
  Stage 4 (2024): "Combine phishing with Any.Run redirect + RMM deployment"

Success Factors Analysis

Why Operation AnyTax is Effective:

Factor	Description	Effectiveness
Authority	CRA/government impersonation	Very High - authority creates urgency
Legitimacy	Any.Run appears as real service	High - uses real, trusted platform
Timing	Tax seasons (spring/fall)	High - aligns with natural deadlines
Customization	Localized lures (CRA/UAE)	High - harder to detect via keyword filters
Simplicity	RMM tools are legitimate	High - easy to persist, difficult to detect
Multi-Stage	Reconnaissance before commitment	Medium - increases success rate but requires more time

Defensive Gaps Exploited:

1. Users trust government authority (CRA)
2. Email gateways weak on spoofed domains
3. RMM tools whitelisted by default
4. Any.Run marked as benign by security vendors
5. Limited user awareness of tax scams
6. Outdated email security configs (weak SPF/DKIM/DMARC)

---

Summary: Network Forensics to Attribution

Complete Chain:

PCAP Analysis
    ↓ (Identify C2 domains, IP addresses)
Network Forensics
    ↓ (Reconstruct attack timeline, identify persistence)
Infrastructure Attribution
    ↓ (Geolocate servers, analyze domain registration)
Tactical Attribution
    ↓ (Compare TTPs to known threat groups)
Campaign Comparison
    ↓ (Assess uniqueness, sophistication, innovation)
Threat Assessment
    ↓ (Determine group capabilities, resources, future risk)
Attribution Confidence

---

End of Combined Network Forensics, Attribution, and Comparative Analysis Document