1. An unauthorized activity capture system comprising: a tap configured to copy network data from a communication network, the network data being associated with an original destination; and a controller coupled to the tap and configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if at least a portion of the copy of the network data has one or more characteristics of a computer worm, flag the at least a portion of the copy of the network data as suspicious based on the heuristic determination, and concurrently replay transmission of the flagged, suspicious copy of the network data to a plurality of destination devices, wherein the plurality of destination devices are configured based on the original destination.