important the snort rule against Regin Snort Rules: 32621-32624
and the command and the control servers were .......
22.214.171.124 Taiwan, Province Of China Taichung Chwbn
126.96.36.199 India Chetput Chennai Network Operations (team-m.co)
188.8.131.52 India Thane Internet Service Provider
184.108.40.206 Belgium Brussels Perceval S.a.
because that won't be found suspicous, going to India or Taiwan for traffic going out in Belgacom could have been found suspicous
remember this is a spy operation so all the classical techniques and reflexes by spies are used - even covering up your tracks .....