Financial Intelligence: Tracking Ransomware Payouts from Network PCAP to Blockchain Attribution

In financial intelligence (FININT) and cyber investigations, tracing the flow of illicit funds frequently requires bridging the gap between network-level artifacts and distributed public ledgers.

This write-up covers the complete methodology for solving the Financial Intelligence challenge on OSINT Industries CTF, progressing from raw packet capture analysis in Wireshark to counterparty attribution using blockchain intelligence platforms.

Tools Used

• Wireshark: Network packet analysis and TCP stream reconstruction.
• Arkham Intelligence: Blockchain analytics, entity clustering, and counterparty tracking.

Step 1: Network Traffic Analysis & Host Profiling

The investigation began with the provided capture file: finint.pcap.

Upon loading the file into Wireshark, the initial objective was to inspect traffic originating from host 10.10.45.12. The capture revealed recurring DNS queries and SSL/TLS handshakes establishing outbound sessions to external infrastructure:

• checkip.amazonaws.com — Public IP resolution
• onion-relay.net — Tor routing infrastructure
• api.telegram.org — Potential automated alerting / C2 channel
• secure-vault.io — External backend infrastructure

Step 2: Isolating Cleartext Communications

While reviewing the traffic flow, an unencrypted HTTP POST request stood out at Frame 65.

The payload indicated that /api/v2/chat/send was transmitting unencrypted JSON data to 185.220.101.9:8080 with the User-Agent DarkChat-Client/3.0.

Following the TCP stream (tcp.stream eq 32) reconstructed the full chat session in the #payouts-private room. In the exchange, user CoinLaunderer requested the deposit destination, and Blackcat responded directly with the ransom payout address

Extracted Payout Address: 14Q5xgBHAkWxDVrnHautcm4PPGmy5cfw6b

Step 3: Blockchain Forensics & Counterparty Attribution

With the target payout address extracted, the investigation pivoted to on-chain analytics using Arkham Intelligence.

Searching for 14Q5xgBHAkWxDVrnHautcm4PPGmy5cfw6b immediately confirmed the entity clustering tag BlackCat / Ransomware.

While recent transfer logs showed smaller transactions, the challenge required identifying the upstream wallet responsible for the primary 350.21 BTC transfer.

To trace the complete funding trail:

1. The timeframe filter was adjusted from the default view to ALL.
2. In the Top Counterparties / Inflow panel, incoming transactions were sorted by total volume.
3. At the top of the counterparty list, the primary source transaction transferring 350.213 BTC (~$21.86M USD valuation) was isolated.

Indicators of Compromise (IOCs) & Key Artifacts

CategoryType / IdentifierContext / DescriptionNetwork185.220.101.9:8080External chat server hosting DarkChat APINetworktcp.stream eq 32TCP Stream containing plaintext ransom negotiationDomainsecure-vault.io, onion-relay.netAssociated external infrastructure in PCAPCrypto (Destination)14Q5xgBHAkWxDVrnHautcm4PPGmy5cfw6bBlackCat ransomware receiving walletCrypto (Origin)bc1q3hzthu4dygxsusjymkmpe8sldpq2wuhzqy2ecvPrimary source sending 350.213 BTC

Key Takeaways

• Unencrypted Network Vectors: Threat actors often rely on bespoke or misconfigured messaging clients (DarkChat), leaving critical financial identifiers exposed in cleartext payloads.
• Multi-Layered Correlation: Combining off-chain network forensics with on-chain blockchain intelligence allows investigators to bridge communications directly to underlying financial infrastructure.
• Volume Filtering: When analyzing high-profile cryptocurrency clusters, expanding timeframes and filtering counterparties by transaction volume is essential for separating primary extortion payouts from intermediate laundering hops.

With the receiving wallet and the primary sending wallet identified, the challenge submission format OSINT{ReceivingWallet_SendingWallet} can be completed directly