You boot into a secure Linux distro from a thumb drive. Packet-sniffing tools activated. The chase is on.
You start analyzing the malware’s traffic patterns. It’s bouncing through multiple proxies, but one of them… slips.
"...Ping back detected. Server in Bucharest."