Hacker News Reader

Notably, the C&C domain has been sinkholed by Kaspersky.

This has been linked to the complex "Turla" industrial espionage malware, as it shares a C&C server. (Turla: http://securelist.com/analysis/publications/65545/the-epic-t... )

The Turla malware sends data back using PHP proxies running on hacked servers. The same PHP proxy script is used by MiniDuke.

MiniDuke in turn screams Russia in its target selection and spear phishing related to the Ukrainian bid to join NATO.

The Ukraine is trying to join NATO? That seems like a recipe for disaster, why not let Russia have a buffer zone of countries it controls..