Russian Nesting Dolls: Turla got into the ISI who was into an Indian Embassy, & how we found them

The talk starts with a 2021 finding: a shortcut file tied to a previously unseen malware family, Reverse RAT, which could copy and spread across removable media. Pivoting from its command-and-control servers, the researchers used network flow data and detection rules to map infrastructure associated with SideCopy, a regional group linked to Pakistan. That mapping showed a server running a Hak5 hardware device banner on port 8080 that drew connections from several Indian government bodies, which pointed to physical access or a hardware implant in those networks.

The investigation then followed Turla, a Russian state-linked group, as it appeared on SideCopy servers. Beaconing from an Afghan government address was seen in 2023, and remote desktop sessions from a Pakistani address lined up in time with Turla activity on the same server, suggesting Turla had reached an operator's workstation. Across roughly two years the team saw signs of compromise on 33 command servers, a documented case the speaker described as rare among nation-state actors.

The closing section lists open questions: how the hardware devices were placed, why Turla deployed its own tools in Afghan networks but apparently not in Indian ones, and what drove the choice of targets. The takeaway for practitioners is that hijacking another group's access can persist unnoticed for years, that network telemetry can expose patterns, and that attribution during incident response often takes far longer than stakeholders expect.