Sisterhood of the Traveling Packets: How 1,300 Practitioners Hacked a Ransomware Gang’s Leak Site (Flare CTF Writeup)

This is a CTF writeup, not a live threat. It details a gamified exercise where 1,300 participants simulated hacking a ransomware gang’s leak site.

Technical Breakdown: – Scenario: Participants were given a PCAP file and tasked with deanonymizing a threat actor (alleged TeamPCP operator) by tracing network traffic. – TTPs (Simulated): The exercise likely covered traffic analysis, protocol fingerprinting, and pivoting from network artifacts to identity (e.g., correlating VPN exit nodes, browser fingerprints, or leaked credentials). – IOCs: None. This is a training dataset, not a live compromise.

Defense: The real-world takeaway is that threat actors leave network-level breadcrumbs (e.g., unique TLS handshakes, DNS patterns, or timing analysis) that can be used for attribution. Teams should practice this skill via controlled CTFs rather than waiting for a live incident.

Source: https://flare.io/learn/resources/blog/sisterhood-traveling-packets-ctf-writeup