Analysis of several backdoors identified in this recent operation revealed that Turla has relied on traditional C&C implementations, using compromised web servers as C&C, as well as utilizing legitimate web services like Pastebin. Additionally, one analyzed sample of Kazuar is configured for commands sent through likely internal nodes in the government's network, while others use the more traditional method of external C&C nodes