{"id":414,"date":"2020-05-18T22:04:50","date_gmt":"2020-05-18T20:04:50","guid":{"rendered":"https:\/\/www.spacesecurity.info\/?p=414"},"modified":"2020-05-18T22:04:50","modified_gmt":"2020-05-18T20:04:50","slug":"back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites","status":"publish","type":"post","link":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/","title":{"rendered":"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites"},"content":{"rendered":"<p>Kaspersky Lab experts were the first to reveal in 2015 that the Russian hacker group Turla APT had exploited and hijacked satellite feeds to hide their Command &amp; Control (C&amp;C) servers.<\/p>\n<p>As a reminder, the Turla APT group, also known as Snake or Uroburos, had in 2015 affected more than 500 victims in 45 different countries around the world, including government agencies, military entities and diplomats as the group&#8217;s preferred targets.<\/p>\n<p><a href=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Turla_Map_of_Targets.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-141\" src=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Turla_Map_of_Targets-1024x642.jpg\" alt=\"\" width=\"696\" height=\"436\" srcset=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Turla_Map_of_Targets-1024x642.jpg 1024w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Turla_Map_of_Targets-300x188.jpg 300w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Turla_Map_of_Targets-768x481.jpg 768w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Turla_Map_of_Targets-696x436.jpg 696w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Turla_Map_of_Targets-1068x670.jpg 1068w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Turla_Map_of_Targets.jpg 1225w\" sizes=\"auto, (max-width: 696px) 100vw, 696px\" \/><\/a><\/p>\n<p>While satellites are best known as tools for broadcasting and secure communication, they are also used for Internet access. Their services are mainly used in remote locations where all other means of Internet access are either unstable and slow or totally inoperative.<\/p>\n<p><a href=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/satellite_Internet_en_6.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-140\" src=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/satellite_Internet_en_6.jpg\" alt=\"\" width=\"934\" height=\"768\" srcset=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/satellite_Internet_en_6.jpg 934w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/satellite_Internet_en_6-300x247.jpg 300w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/satellite_Internet_en_6-768x632.jpg 768w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/satellite_Internet_en_6-696x572.jpg 696w\" sizes=\"auto, (max-width: 934px) 100vw, 934px\" \/><\/a><\/p>\n<p>One of the most widespread and inexpensive methods of satellite Internet access is an exclusively downlink, with the uplink being via conventional low-speed Internet access.<\/p>\n<p>The use of a satellite internet connection offers undeniable advantages such as anonymity. Indeed, apart from knowing that you are under satellite coverage, it is very difficult if not impossible to physically know your location.<\/p>\n<p>Another advantage of hijacking satellite links is the low cost of hardware investment. Here, hackers have hijacked a DVB-S satellite link. To hijack this type of link, you need the following items, the cost of which is estimated at less than 1000 euros:<\/p>\n<ul>\n<li>A satellite dish, the size of which depends on the geographical position and the satellite.<\/li>\n<li>A universal head<\/li>\n<li>A dedicated DVB-S tuner (PCIe card)<\/li>\n<li>A computer, preferably running Linux<\/li>\n<\/ul>\n<p><a style=\"text-align: center;\" href=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/satellite_internet_fr_11.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-143 size-full\" src=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/satellite_internet_fr_11.jpg\" alt=\"\" width=\"1000\" height=\"785\" \/><\/a><\/p>\n<p>PCIe TBS-6922SE card for DVB-S canal receptionThe method is not new. It goes back to the 2010&#8217;s with the <a href=\"https:\/\/www.theguardian.com\/technology\/2009\/dec\/17\/skygrabber-software-drones-hacked\">Skygrabber<\/a> software. A person with a PC and a satellite dish can, with the software, intercept downloads requested by Internet users connected to a satellite. Indeed, the downlink transmitted from the satellite in geostationary orbit to the computer was not encrypted at the time.<\/p>\n<h2>How a satellite internet connection is hijacked<\/h2>\n<p>The <a href=\"https:\/\/securelist.com\/satellite-turla-apt-command-and-control-in-the-sky\/72081\/\">SecureList.com<\/a> site explains the technique very well. The Turla APT group has exploited a weakness of satellite internet connections of the DVB-S type which is that the stream is not encrypted.<\/p>\n<figure id=\"attachment_154\" aria-describedby=\"caption-attachment-154\" style=\"width: 696px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Flux-DVB-S-non-chiffr\u00e9.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-154 size-large\" src=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Flux-DVB-S-non-chiffr\u00e9-1024x581.jpg\" alt=\"\" width=\"696\" height=\"395\" srcset=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Flux-DVB-S-non-chiffr\u00e9-1024x581.jpg 1024w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Flux-DVB-S-non-chiffr\u00e9-300x170.jpg 300w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Flux-DVB-S-non-chiffr\u00e9-768x436.jpg 768w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Flux-DVB-S-non-chiffr\u00e9-696x395.jpg 696w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Flux-DVB-S-non-chiffr\u00e9-1068x606.jpg 1068w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/Flux-DVB-S-non-chiffr\u00e9.jpg 1206w\" sizes=\"auto, (max-width: 696px) 100vw, 696px\" \/><\/a><figcaption id=\"caption-attachment-154\" class=\"wp-caption-text\">Cr\u00e9dits : Fran\u00e7ois Quiquet<\/figcaption><\/figure>\n<p>The technique used here is not Man-In-The-Middle but IP Spoofing.<\/p>\n<ol>\n<li>The group starts by &#8220;listening&#8221; to the satellite downlink in order to identify the active IP addresses of the Internet users connected to the satellite.<\/li>\n<li>It chooses a connected IP address to use it to mask a C&amp;C server, without the knowledge of the legitimate user. To do this, he configures the domain name of his Command &amp; Control server to use one of the active IP addresses connected via satellite.<\/li>\n<li>Machines infected with the Turla malware are instructed to filter data to the domain name whose IP addresses correspond to Internet users connected via satellite (hackers use so-called dynamic DNS hosting, which allows them to change the IP address of a domain at will).<\/li>\n<li>The malware on the infected computers then contacts the IP address of the legitimate user connected to the satellite to establish a TCP\/IP connection.<\/li>\n<li>The data is routed via conventional lines to the teleports of the satellite Internet service provider, then to the satellite, and finally from the satellite to the user whose IP address has been chosen.<\/li>\n<li>This user&#8217;s machine will abandon the connection because the communication is not intended for him (the port chosen by the attackers is not open on the user&#8217;s machine).<\/li>\n<li>The same TCP\/IP connection request is also sent to the attackers&#8217; Command &amp; Control server, which uses the same IP address and will respond to the infected machine to establish a communication channel and receive the exfiltered data.<\/li>\n<\/ol>\n<p><a href=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-139 size-large\" src=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection-1024x718.jpg\" alt=\"\" width=\"696\" height=\"488\" srcset=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection-1024x718.jpg 1024w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection-300x210.jpg 300w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection-768x539.jpg 768w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection-696x488.jpg 696w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection-1068x749.jpg 1068w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection-100x70.jpg 100w, https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection.jpg 1095w\" sizes=\"auto, (max-width: 696px) 100vw, 696px\" \/><\/a><\/p>\n<p>Interestingly, as you will have noticed, the legitimate user, whose IP address has been used by hackers to retrieve data from an infected machine, also receives these data packets but hardly notices them. In fact, Turla members instruct infected machines to send data to ports that, in the majority of cases, are closed by default. As a result, the legitimate user&#8217;s computer simply discards these packets, while the Turla C&amp;C server, which keeps these ports open, receives and processes the exfiltered data.<\/p>\n<p>The legitimate satellite user will not even notice that his satellite connection has been hijacked unless he checks his event logs and notices packets being discarded by his satellite modem. But this will look more like &#8220;Internet noise&#8221; than suspicious traffic.<\/p>\n<h2>Short explanatory video<\/h2>\n<p><iframe loading=\"lazy\" src=\"https:\/\/www.youtube.com\/embed\/Du3rBVZqKkk\" width=\"560\" height=\"315\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\" data-mce-fragment=\"1\"><\/iframe><\/p>\n<p>The use of satellite links to hide a Command &amp; Control server and control a botnet is not exclusive to Turla APT. Researchers have observed that other APT groups also rely on satellites to manage their malware such as Rocket Kitten or Xumuxu or the Hacking Team in Italy. We&#8217;ll talk about this in a future article.<\/p>\n<p><strong>The question now is whether DVB-S satellite internet connections are now encrypted to protect confidentiality and integrity. If anyone has the answer, I&#8217;d like to have it as a comment. This will also be the subject of a future article.<\/strong><\/p>\n<p>Source and technical details on <a href=\"https:\/\/securelist.com\/satellite-turla-apt-command-and-control-in-the-sky\/72081\/\">Kaspersky Lab&#8217;s SecureList.com<\/a> website.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Kaspersky Lab experts were the first to reveal in 2015 that the Russian hacker group Turla APT had exploited and hijacked satellite feeds to hide their Command &amp; Control (C&amp;C) servers. As a reminder, the Turla APT group, also known as Snake or Uroburos, had in 2015 affected more than 500 victims in 45 different [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":416,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22,26,28],"tags":[],"class_list":{"0":"post-414","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-hacking-en","8":"category-russia-en","9":"category-satellite-en"},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites - Space &amp; Cybersecurity Info<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites - Space &amp; Cybersecurity Info\" \/>\n<meta property=\"og:description\" content=\"Kaspersky Lab experts were the first to reveal in 2015 that the Russian hacker group Turla APT had exploited and hijacked satellite feeds to hide their Command &amp; Control (C&amp;C) servers. As a reminder, the Turla APT group, also known as Snake or Uroburos, had in 2015 affected more than 500 victims in 45 different [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/\" \/>\n<meta property=\"og:site_name\" content=\"Space &amp; Cybersecurity Info\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-18T20:04:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1095\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fran\u00e7ois Quiquet\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fran\u00e7ois Quiquet\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/\"},\"author\":{\"name\":\"Fran\u00e7ois Quiquet\",\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/#\\\/schema\\\/person\\\/5e36ba49bf1d87a387c9ab60c233013c\"},\"headline\":\"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites\",\"datePublished\":\"2020-05-18T20:04:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/\"},\"wordCount\":864,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.spacesecurity.info\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/How_Turla_abuses_satellite_connection.jpg\",\"articleSection\":[\"Hacking\",\"Russia\",\"Satellite\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/\",\"url\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/\",\"name\":\"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites - Space &amp; Cybersecurity Info\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.spacesecurity.info\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/How_Turla_abuses_satellite_connection.jpg\",\"datePublished\":\"2020-05-18T20:04:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.spacesecurity.info\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/How_Turla_abuses_satellite_connection.jpg\",\"contentUrl\":\"https:\\\/\\\/www.spacesecurity.info\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/How_Turla_abuses_satellite_connection.jpg\",\"width\":1095,\"height\":768},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/\",\"name\":\"Space Cybersecurity Info\",\"description\":\"La cybers\u00e9curit\u00e9 appliqu\u00e9e au domaine de l&#039;espace\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/#organization\",\"name\":\"Space Security Info\",\"url\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.spacesecurity.info\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/SSI-Logo-4.jpg\",\"contentUrl\":\"https:\\\/\\\/www.spacesecurity.info\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/SSI-Logo-4.jpg\",\"width\":594,\"height\":144,\"caption\":\"Space Security Info\"},\"image\":{\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/#\\\/schema\\\/person\\\/5e36ba49bf1d87a387c9ab60c233013c\",\"name\":\"Fran\u00e7ois Quiquet\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e50e669b3dbfb22c278a01d57cebe52e5b3900d3301faa1c4fefe35cd22d2186?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e50e669b3dbfb22c278a01d57cebe52e5b3900d3301faa1c4fefe35cd22d2186?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e50e669b3dbfb22c278a01d57cebe52e5b3900d3301faa1c4fefe35cd22d2186?s=96&d=mm&r=g\",\"caption\":\"Fran\u00e7ois Quiquet\"},\"description\":\"(EN) I'm a cybersecurity engineer in network, telecommunication and embedded\\\/integrated systems. Founder of the website spacesecurity.info. Passionate about cybersecurity and space, I share my two passions through this site. My goal is to federate a community around these two themes. Join my LinkedIn Group. (FR) Je suis ing\u00e9nieur cybers\u00e9curit\u00e9 en r\u00e9seau, t\u00e9l\u00e9communication et syst\u00e8mes embarqu\u00e9s et int\u00e9gr\u00e9s. Fondateur du site spacesecurity.info. Passionn\u00e9 de cybers\u00e9curit\u00e9 et du monde de l'espace, j'ai souhait\u00e9 partager mes deux passions \u00e0 travers ce site. Mon objectif est de f\u00e9d\u00e9rer une communaut\u00e9 autour de ces deux th\u00e8mes. Rejoindre mon groupe LinkedIn.\",\"sameAs\":[\"https:\\\/\\\/www.spacesecurity.info\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/francoisquiquet\\\/\"],\"url\":\"https:\\\/\\\/www.spacesecurity.info\\\/en\\\/author\\\/francois\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites - Space &amp; Cybersecurity Info","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/","og_locale":"en_US","og_type":"article","og_title":"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites - Space &amp; Cybersecurity Info","og_description":"Kaspersky Lab experts were the first to reveal in 2015 that the Russian hacker group Turla APT had exploited and hijacked satellite feeds to hide their Command &amp; Control (C&amp;C) servers. As a reminder, the Turla APT group, also known as Snake or Uroburos, had in 2015 affected more than 500 victims in 45 different [&hellip;]","og_url":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/","og_site_name":"Space &amp; Cybersecurity Info","article_published_time":"2020-05-18T20:04:50+00:00","og_image":[{"width":1095,"height":768,"url":"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection.jpg","type":"image\/jpeg"}],"author":"Fran\u00e7ois Quiquet","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fran\u00e7ois Quiquet","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/#article","isPartOf":{"@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/"},"author":{"name":"Fran\u00e7ois Quiquet","@id":"https:\/\/www.spacesecurity.info\/en\/#\/schema\/person\/5e36ba49bf1d87a387c9ab60c233013c"},"headline":"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites","datePublished":"2020-05-18T20:04:50+00:00","mainEntityOfPage":{"@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/"},"wordCount":864,"commentCount":0,"publisher":{"@id":"https:\/\/www.spacesecurity.info\/en\/#organization"},"image":{"@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/#primaryimage"},"thumbnailUrl":"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection.jpg","articleSection":["Hacking","Russia","Satellite"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/","url":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/","name":"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites - Space &amp; Cybersecurity Info","isPartOf":{"@id":"https:\/\/www.spacesecurity.info\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/#primaryimage"},"image":{"@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/#primaryimage"},"thumbnailUrl":"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection.jpg","datePublished":"2020-05-18T20:04:50+00:00","breadcrumb":{"@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/#primaryimage","url":"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection.jpg","contentUrl":"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/How_Turla_abuses_satellite_connection.jpg","width":1095,"height":768},{"@type":"BreadcrumbList","@id":"https:\/\/www.spacesecurity.info\/en\/back-to-turla-or-how-a-russian-speaking-cyber-espionage-group-exploits-satellites\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.spacesecurity.info\/en\/"},{"@type":"ListItem","position":2,"name":"Back to Turla or how a Russian-speaking cyber-espionage group exploits satellites"}]},{"@type":"WebSite","@id":"https:\/\/www.spacesecurity.info\/en\/#website","url":"https:\/\/www.spacesecurity.info\/en\/","name":"Space Cybersecurity Info","description":"La cybers\u00e9curit\u00e9 appliqu\u00e9e au domaine de l&#039;espace","publisher":{"@id":"https:\/\/www.spacesecurity.info\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.spacesecurity.info\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.spacesecurity.info\/en\/#organization","name":"Space Security Info","url":"https:\/\/www.spacesecurity.info\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.spacesecurity.info\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/SSI-Logo-4.jpg","contentUrl":"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2020\/05\/SSI-Logo-4.jpg","width":594,"height":144,"caption":"Space Security Info"},"image":{"@id":"https:\/\/www.spacesecurity.info\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.spacesecurity.info\/en\/#\/schema\/person\/5e36ba49bf1d87a387c9ab60c233013c","name":"Fran\u00e7ois Quiquet","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e50e669b3dbfb22c278a01d57cebe52e5b3900d3301faa1c4fefe35cd22d2186?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e50e669b3dbfb22c278a01d57cebe52e5b3900d3301faa1c4fefe35cd22d2186?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e50e669b3dbfb22c278a01d57cebe52e5b3900d3301faa1c4fefe35cd22d2186?s=96&d=mm&r=g","caption":"Fran\u00e7ois Quiquet"},"description":"(EN) I'm a cybersecurity engineer in network, telecommunication and embedded\/integrated systems. Founder of the website spacesecurity.info. Passionate about cybersecurity and space, I share my two passions through this site. My goal is to federate a community around these two themes. Join my LinkedIn Group. (FR) Je suis ing\u00e9nieur cybers\u00e9curit\u00e9 en r\u00e9seau, t\u00e9l\u00e9communication et syst\u00e8mes embarqu\u00e9s et int\u00e9gr\u00e9s. Fondateur du site spacesecurity.info. Passionn\u00e9 de cybers\u00e9curit\u00e9 et du monde de l'espace, j'ai souhait\u00e9 partager mes deux passions \u00e0 travers ce site. Mon objectif est de f\u00e9d\u00e9rer une communaut\u00e9 autour de ces deux th\u00e8mes. Rejoindre mon groupe LinkedIn.","sameAs":["https:\/\/www.spacesecurity.info","https:\/\/www.linkedin.com\/in\/francoisquiquet\/"],"url":"https:\/\/www.spacesecurity.info\/en\/author\/francois\/"}]}},"_links":{"self":[{"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/posts\/414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/comments?post=414"}],"version-history":[{"count":2,"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/posts\/414\/revisions"}],"predecessor-version":[{"id":421,"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/posts\/414\/revisions\/421"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/media\/416"}],"wp:attachment":[{"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/media?parent=414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/categories?post=414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.spacesecurity.info\/en\/wp-json\/wp\/v2\/tags?post=414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}