Turla has been around for many years as a state-sponsored actor and will likely not go away soon. Adversaries like Turla often use sophisticated malware, but they also often use what is good enough to fly under the radar. Talos has monitored many noisy Turla operations, for example. During their campaigns, they are often using and re-using compromised servers for their operations, which they access via SSH, often protected by TOR. One public reason why we attributed this backdoor to Turla is the fact that they used the same infrastructure as they used for other attacks that have been clearly attributed to their Penguin Turla Infrastructure. We will continue to monitor Turla and the other state-sponsored actors to protect our customers against these attacks. It isn't unlikely that the adversaries will manage to bypass one or the other security measures, but it is much harder for them to bypass all of them. These campaigns and the refinement of the TTPs being used will likely continue for the foreseeable future