Russian hacking group uses satellites to hide command and control servers (C&C Servers)
For the past 8 years, the notorious Turla APT (Advanced Persistent Threat) cyber espionage group has managed to remain invisible, cleverly evading law enforcement and cybersecurity firms. However, Kaspersky Lab has recently managed to uncover how the group evades detection and ensures its anonymity.
As the researchers point out, the attackers are using satellite Internet connections to hide their command and control (C&C) servers.
The sophisticated cyber-espionage group, which is allegedly made up of Russian-speaking hackers, has been operating since 2007, but it was only last year that Kaspersky security researchers were able to shed light on its activities.
Kaspersky researcher Stefan Tanase reports that by exploiting security vulnerabilities in the design of older technology communications satellites, attackers are able to intercept internet traffic and use it to hide the location of C&C servers .
Most of the satellites orbiting the Earth have been around for decades and as a result do not carry support for encrypted connections, a measure that has only become necessary in recent years.
This particular flaw in the design of these satellites is now being exploited by the Turla group, which uses simple satellite dishes to easily intercept the traffic transmitted from the satellite to a randomly selected user. Since the data traffic is not encrypted, hackers can easily perform a MITM (Man-in-the-middle) attack, intercepting the traffic intended for the user's IP and using it to carry out illegal activities.
