On a desert world, Hydra Saiga mines “spicetelligence” from government, defense, and infrastructure targets across Central Asia, the Middle East, and Eastern Europe. This APT aligns with its sponsor’s geopolitical interests—specifically water and gas strategy—while largely evading Western scrutiny. We will explore their TTPs and targets using a custom tool that intercepts the actor’s Telegram-as-a-C2 communications, revealing exclusive insights into victimology, post-exploitation activity, and attribution. Defenders will learn practical prevention strategies, while researchers will gain a novel methodology for Telegram-based intelligence gathering to track similar campaigns. By bringing this secretive actor into the light, we broaden our collective understanding of emerging cyber-powers and the future of resource-driven conflict. By the end of this talk, every attendee will be ready to ride their own sandworm through the shifting sands of modern espionage.
