Are GTP packets exchanged between peering providers? As in, would the C2 server have to be operated by a complicit telco in order to receive the packets? Or do they make it to the public Internet somewhere?
If it's the former, then it seems very un-stealthy. Like, if the GTP packets are making their way back to e.g. China Unicom, it's going to be hard to deny they were in on the operation. Which, maybe they don't care, but it seems like they're risking blacklisting.
If it's the former, then it seems very un-stealthy. Like, if the GTP packets are making their way back to e.g. China Unicom, it's going to be hard to deny they were in on the operation. Which, maybe they don't care, but it seems like they're risking blacklisting.