13.10 Cross-Wave Correlation

Cross-Wave Correlation

With all five waves documented, connect them into a single campaign view. This analysis feeds into the incident report, threat intelligence sharing, and detection engineering.

Campaign infrastructure analysis

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

EmailEvents
| where TimeGenerated between (datetime(2026-02-27T00:00:00Z) .. datetime(2026-03-02T00:00:00Z))
| where SenderMailFromDomain has_any ("northgate-voicemail", "northgate-docs",
    "northgateeng-support", "northgate-benefits", "northgate-projects")
| summarize
    EmailCount = count(),
    Recipients = dcount(RecipientEmailAddress),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by SenderMailFromDomain
| sort by FirstSeen asc

Campaign summary:

Patterns identified:

• All domains follow the pattern northgate-[word][.]com — impersonating the target organisation name
• Domains registered 1-2 days before each wave — disposable infrastructure
• Hosting rotated across US, NL, DE VPS providers — preventing IP-based blocking
• URL path pattern consistent across all waves: /auth/[a-f0-9]{32}/login

IOC extraction for threat intelligence sharing

The following IOCs should be shared with your sector ISAC, managed SOC partner, and any peer organisations:

Domains: northgate-voicemail[.]com, northgate-docs[.]com, northgateeng-support[.]com, northgate-benefits[.]com, northgate-projects[.]com

URL pattern: /auth/[a-f0-9]{32}/login (phishing kit signature)

Attacker IP (token replay): 203.0.113.45

Sending IPs: (extracted from email headers per wave)

Kit indicators: Cloudflare turnstile CAPTCHA on proxy landing page. Tycoon 2FA-style login page structure.