I assume by looking at the command and control ips and looking for what is common. (IE that they were from satellite ISPs)

You can read the original post here: https://securelist.com/72081/satellite-turla-apt-command-and...