Charming_Kitten__2019__Twas_the_night_before.pdf

NewsBeef (reported as NewsBeef/APT33) ran a 2016–2017 campaign targeting Saudi Arabian government and related organizations using spearphishing (malicious macro-enabled Office documents), watering-hole JavaScript injections that fingerprint and redirect victims, and poisoned installers that launch PowerShell downloaders, PowerSploit reflective injection, and an in-memory Pupy backdoor communicating to obfs3-protected C2 servers; the report includes technical analysis and many IOCs (MD5s, domains, IPs, URLs).