APT33__2019__More_than_a_Dozen_Obfuscated_APT33_Botnets_Used_for_Extreme_Narrow_Targeting.pdf

Trend Micro reports that APT33 has operated more than a dozen small, highly targeted botnets using multiple obfuscation layers (cloud proxies, shared webserver backends, and private OpenVPN exit nodes) to persist in networks of high-value targets—particularly in the oil, aviation, and military sectors across the Middle East, U.S., and Asia. The report includes lists of spear-phishing sender addresses, C2 domains, VPN exit-node IP addresses, and SHA256s for observed malware samples, documents evidence of active infections in supply-chain organizations and recommends remediation and detection measures.