APT33__2017__Insights_into_Iranian_Cyber_Espionage_APT33_Targets_Aerospace_and_Energy_Sectors_and_has_Ties_to_Destructive_Malware_Threat_Research_Blog_FireEye_Inc.pdf

FireEye details APT33, a suspected Iran-linked APT active since at least 2013 that has targeted aerospace and energy organizations in the United States, Saudi Arabia, and South Korea using spear-phishing and malicious .hta lures; the report describes custom and public backdoors (TURNEDUP, DROPSHOT, NANOCORE, NETWIRE), potential ties to destructive wiper malware (SHAPESHIFT), provides domains, hashes and C2s as IOCs, and assesses operational patterns and indicators that suggest government sponsorship and high capability.