Lots of steganography techniques are mandated by the government agencies, such as microdots printed by inkjet and laser printers that can uniquely identify the printer, ADC and codec chips that can add modulation signatures to voice calls and video streams and so on.
In this case, he probably used TOR - which is notoriously infiltrated by government server nodes- and a SIP relay that might be hosted on Russian servers but might send hidden telemetry that the operator might not even know is going out.