Cyber Espionage by APT33 Targets Education, National Security, and Oil Industries

Trend Micro researchers documented APT33's use of more than a dozen obfuscated C2 servers for highly targeted espionage operations. Each C2 server controls a micro-botnet of only about 12 infected machines — not the thousands typical of criminal botnets — reflecting a deliberate strategy of staying under the radar. Confirmed victims include US national security companies, universities, a military-related organization, and oil industry companies across the UK, Europe, and the Middle East.

The attacks are attributed to APT33, also known as Elfin, Refined Kitten, or HOLMIUM — an Iranian state-linked threat group active since at least 2013. APT33 is known for targeting the oil and aviation sectors and has been linked to destructive malware (Shamoon/Disttrack) in addition to espionage operations. Trend Micro has tracked this group's C2 infrastructure since at least 2016.

The primary goal is espionage and persistent access. The malware deployed gives operators a foothold for downloading additional tools and maintaining covert presence in target networks. The extreme narrowness of each botnet — only ~12 victims per C2 — suggests high-value, deliberate targeting rather than broad reconnaissance. Given APT33's known use of destructive malware in other campaigns, Trend Micro warns that confirmed infections should be treated as a potential precursor to sabotage operations.

Trend Micro tracked 10 active bot aggregators in fall 2019, each controlling only about 12 victims. Confirmed 2019 victims span the US (two national security company locations, two universities, one military-related victim) and multiple Middle East and Asia targets. In 2018, Trend Micro observed two oil industry compromises in real time. The spear phishing campaigns targeting oil supply chains ran continuously from December 2016 through at least October 2018, targeting recipients at major industry-relevant organizations including a US military water facility.

APT33 targets oil and gas companies, aerospace and aviation firms, national security organizations, universities, and military entities primarily across the Middle East, US, and Asia. The job-lure spear phishing campaigns specifically spoofed major oil and aviation brands — al-Salam Aircraft Company, NGAAKSA, DynCorp, SIPCHEM, Saudi Aramco, and SAMREF — indicating deliberate focus on the oil supply chain and aerospace sector workforces as entry points into high-value targets.

APT33 sent job-offer spear phishing emails from addresses impersonating aviation and oil company HR departments. Once a target opened a malicious attachment or link, the malware (MsdUpdate.exe) installed itself with persistence and connected to C2 through a multi-hop chain: first to a cloud-hosted proxy domain, which relayed traffic to a shared webserver backend, which reported to a dedicated bot aggregator. APT33 operators then connected to those aggregators through a private VPN network with frequently rotated exit nodes, issuing commands and collecting stolen data. The chain ensures that tracing back to the true operators requires penetrating multiple layers of infrastructure across different providers.

Oil and gas companies represent strategic targets for Iranian intelligence given Iran's position as a major energy producer competing directly with Gulf state rivals. Disrupting or monitoring Saudi Aramco, SIPCHEM, and their supply chain provides both commercial intelligence and potential leverage for destructive operations. Aerospace and aviation companies are targeted for military intelligence value and as vectors into defense supply chains. US national security organizations and universities are targeted for political, scientific, and strategic intelligence relevant to Iranian foreign policy and weapons development programs.