A group of Russian hackers that researchers are calling Turla are using commercial satellites to steal data from military and diplomatic agencies around the world, including in the United States, China, and Europe, according to The Washington Post. The group, which has been around for at least eight years, is named after the malicious software that they use to steal data and hide their location.
"For us, it was very surprising," said Stefan Tanase, senior security researcher at the Moscow-based cybersecurity firm Kaspersky Lab. "We've never seen a malicious operation that hijacked satellite connections to obtain data and to cover its tracks. This is the first group that we believe has done it. It allows you to achieve a much greater level of anonymity."
According to Tanase, Turla targets diplomatic and military agencies with the goal of gaining political and strategic information by using older satellites that do no encrypt the data that they stream to Earth., reported the International Business Times. They often use Internet connections in the Middle East and Africa, where law enforcement is easier to avoid.
"[This technique] essentially makes it impossible for someone to shut down or see their command servers," said Tanase. "No matter how many levels of proxies you use to hide your server, investigators who are persistent enough can reach the final IP address. It's just a matter of time until you get discovered. But by using this satellite link, it's almost impossible to get discovered."
If more criminal gangs adopt this technique, law enforcement agencies will have a harder time tracking their point of operation and shutting them down, according to Wired.
