Satellite Turla: APT Command and Control in the Sky - Securelist

An in-depth analysis of Turla's use of satellite-based Internet links for C2, outlining how the group hijacks satellite DVB-S connections to evade takedowns, the geographic selection of providers in Africa and the Middle East, sample indicators of compromise and backdoor details (Agent.DNE), and comparisons to other groups that have used similar satellite-based C2 methods, highlighting the low-cost, highly anonymous nature of this technique and its implications for defenders.