important the snort rule against Regin Snort Rules: 32621-32624
and the command and the control servers were .......
126.96.36.199 Taiwan, Province Of China Taichung Chwbn
188.8.131.52 India Chetput Chennai Network Operations (team-m.co)
184.108.40.206 India Thane Internet Service Provider
220.127.116.11 Belgium Brussels Perceval S.a.
because that won't be found suspicous, going to India or Taiwan for traffic going out in Belgacom could have been found suspicous
remember this is a spy operation so all the classical techniques and reflexes by spies are used - even covering up your tracks .....