Analysis of several backdoors identified in this recent operation revealed that Turla has relied on traditional C&C implementations, using compromised web servers as C&C, as well as utilizing legitimate web services like Pastebin. Additionally, one analyzed sample of Kazuar is configured for commands sent through likely internal nodes in the government's network, while others use the more traditional method of external C&C nodes. Varying the C&C ensures multiple avenues of recovery into the network if some of the group’s accesses are found and remediated against by network defenders