I can't confirm that it works but I was going off this: > Administrators who want to check for Turla-infected Linux systems can check outgoing traffic for conn

I can't confirm that it works but I was going off this: > Administrators who want to check for Turla-infected Linux systems can check outgoing traffic for connections to news-bbc.podzone[.]org or 80.248.65.183, which are the addresses of known command and control channels hardcoded into the Linux trojan. Admins can also build a signature using a tool called YARA that detects the strings "TREX_PID=%u" and "Remote VS is empty !"