Instagram Extension Firefox / Turla apt is using a backdoored firefox extension to compromised targets' systems, and it uses instagram comments to discover the url of its c&c server.