Russian APT hacked Iranian APT's infrastructure back in 2017

Turla APT hacked Iran's APT34 group and used its C&C servers to re-infect APT34 victims with its own malware.