Our SOC detected unusual outbound traffic on the Linux workstation of a diplomat stationed in South Asia. The traffic does not use standard HTTPS but appears to establish a persistent tunnel to a strange domain.