Investigation Report: Codex Circuit - Slack Data Exfiltration#

1. Initial Triage#

Objective: Understand the scope and nature of the PCAP file

Actions Taken:

1
from scapy.all import rdpcap
2
packets = rdpcap('megacorp.pcap')
3
print(f"Total packets: {len(packets)}")

Results:

• Packet count: 234,337
• Capture timeframe: ~22 minutes
• Identified 1,184 HTTP packets
• Found 446 Slack API requests

2. Protocol Analysis#

Objective: Identify Slack-specific traffic patterns

Findings:

• Slack uses HTTPS for all API communication
• File uploads use files.upload API endpoint
• File shares trigger file_shared WebSocket events
• Conversation history available via conversations.history

3. File Upload Timeline Reconstruction#

Method: Searched for file upload events by parsing JSON payloads in HTTP POST requests.

Python Code:

1
file_events = []
2
for packet in packets:
3
    if packet.haslayer('Raw'):
4
        payload = packet['Raw'].load.decode('latin-1', errors='ignore')
5
        file_matches = re.findall(
6
            r'"name":"([^"]+\.(?:xls|pdf|png|docx))"[^}]*"timestamp":(\d+)',
7
            payload
8
        )
9
        for filename, ts in file_matches:
10
            file_events.append({'filename': filename, 'timestamp': int(ts)})

Timeline Discovered:

Critical Observation:
6-minute gap between internal share (11:51:36) and rogue upload (11:57:48) suggests opportunistic exfiltration.

Internal User Analysis#

Challenge: User ID U09KA40P3F0 had no profile data in PCAP

Resolution Method: Analyzed conversation messages for context clues:

Packet Analysis:

1
Conversation_18.json:
2
{
3
  "text": "thanks for sharing, Ava, I am sure James could also comment",
4
  "user": "U09KAAYFSBY",
5
  "ts": "1760097020.187409"
6
}

Draft Message (Packet 20):

1
{
2
  "user_id": "U09KA40P3F0",
3
  "text": "no worries, here's the latest customer",
4
  "channel_id": "C09L7LPF4Q1"
5
}

Conclusion:
User U09KA40P3F0 = Ava (confirmed via conversation context)

Threat Actor Identification#

User Profile Discovery (Packet 26916):

1
{
2
  "type": "user_change",
3
  "user": {
4
    "id": "U09KRBDV8S1",
5
    "team_id": "T09KSNJU27Q",
6
    "name": "jamesb",
7
    "real_name": "james brown"
8
  }
9
}

Rogue Upload Confirmation (Packet 27162):

1
{
2
  "user": "U09KRBDV8S1",
3
  "files": [{
4
    "name": "sensitive_customer_list.xls",
5
    "size": 6656
6
  }],
7
  "team": "T09KSNJU27Q"
8
}

Conclusion:
User U09KRBDV8S1 = James Brown (rogue workspace uploader)

Excel File Extraction#

Method:
Located file data in packet 21194 (multipart/form-data boundary)

Extraction Process:

1
import pandas as pd
2
df = pd.read_excel('sensitive_customer_list.xls')
3
print(df.to_string())

Recovered Data:

Data Sensitivity Assessment:

• High Risk: Customer PII (emails, phone numbers)
• Financial Impact: $300,000 total account value
• Compliance: Potential GDPR/privacy violations

Key Distinction: Upload vs. Share#

Upload Event (Packet 21222):

1
{
2
  "type": "message",
3
  "user": "U09KA40P3F0",
4
  "files": [{
5
    "id": "F09KYB2DERJ",
6
    "created": 1760097092,
7
    "timestamp": 1760097092
8
  }]
9
}

• Time: 11:51:32 GMT
• Action: File uploaded to Slack
• Visibility: Limited (not yet shared)

Share Event (Packet 21237):

1
{
2
  "type": "file_shared",
3
  "file_id": "F09KYB2DERJ",
4
  "user_id": "U09KA40P3F0",
5
  "channel_id": "C09L7LPF4Q1",
6
  "ts": "1760097096.001600"
7
}

• Time: 11:51:36 GMT (4 seconds later)
• Action: File shared to channel
• Visibility: All channel members can now access

Significance:
The share event is the critical moment when data became accessible to James Brown.

Network Indicators#

• Rogue Domain: secret-ops-workspace.slack.com
• Rogue Team ID: T09KSNJU27Q
• Rogue Channel: C09KSNR5F6J

File Indicators#

• Filename: sensitive_customer_list.xls
• File Hash (from PCAP): F09KYB2DERJ (Slack file ID)
• File Size: 6,656 bytes
• MIME Type: application/vnd.ms-excel

User Indicators#

• Suspicious User: U09KRBDV8S1 (James Brown, jamesb)
• Compromised User: U09KA40P3F0 (Ava) - possibly social engineered

Immediate Actions#

1. Revoke Access: Disable James Brown’s account (U09KRBDV8S1)
2. Audit Activity: Review all file shares by James Brown
3. Notify Customers: Inform affected customers (Horizon Analytics, Beta Retail, Nova Energy)
4. Preserve Evidence: Secure PCAP file and Slack workspace logs

Short-term (1-3 months)#

1. DLP Implementation: Deploy Slack DLP to detect sensitive data patterns
2. Workspace Policy: Restrict users to single Slack workspace
3. File Classification: Implement sensitivity labels for documents
4. Monitoring Enhancement: Real-time alerts for file exfiltration

Long-term (3-12 months)#

1. Zero Trust Architecture: Implement least-privilege access model
2. User Behavior Analytics: Deploy UEBA to detect anomalous file activity
3. Security Awareness: Train staff on data handling and insider threats
4. Incident Response: Develop playbook for collaboration tool exfiltration

Technical Insights#

1. PCAP Analysis: Slack API traffic contains rich forensic evidence
2. Event Sequencing: Upload Share - understand application-level events
3. User Attribution: Context clues (conversation messages) can identify users
4. File Recovery: Exfiltrated files can be extracted from packet captures

Security Insights#

1. Collaboration Tools = Attack Surface: Slack/Teams can be weaponized
2. Insider Threats: Trusted users with multi-workspace access pose risk
3. Network Monitoring: Even encrypted traffic reveals patterns and metadata
4. Timeline Matters: Understanding event sequence reveals attack methodology