Are these satellites in geosynchronous orbit? If not, and you've got a copy of the malware, you ought to be able to narrow the location of the C&C server using its orbit and a correlation analysis of when the malware receives comms from the C&C. Depending on the orbit, I'll bet you could bracket it to a few degrees. Since the attackers can't stop answering C&C calls or their network collapses, merely publishing that you're doing such a search might be enough to disrupt their operations.

Then again, maybe this blog post was just such an announcement.

EDIT: I'm willing to bet that satellite downlink performance degrades in bad weather, so even if the sats are in geo-sync, you can just wait for inclement weather to mask a region of the cone.