Trend Micro reveals that over a dozen obfuscated APT33 botnets have been used for extreme narrow targeting

The threat group regularly referred to as APT33 is known to target the oil and aviation industries aggressively, Trend Micro revealed. This threat group has been reported on consistently for years, but recent findings show that the group has been using about a dozen live Command and Control (C&C) servers for extremely narrow targeting. 

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.

The group puts up multiple layers of obfuscation to run these C&C servers in extremely targeted malware campaigns against organizations in the Middle East, the U.S., and Asia.

“We believe these botnets, each comprising a small group of up to a dozen infected computers, are used to gain persistence within the networks of select targets,” Trend Micro wrote in a post this week. 

The malware is rather basic, and has limited capabilities that include downloading and running additional malware. Among active infections in 2019 are two separate locations of a private American company that offers services related to national security, victims connecting from a university and a college in the U.S., a victim most likely related to the U.S. military, and several victims in the Middle East and Asia.

APT33 has also been executing more aggressive attacks over the past few years. For example, for at least two years the group used the private website of a high-ranking European politician (a member of the country’s defense committee) to send spear phishing emails to companies that are part of the supply chain of oil products. Targets included a water facility that is used by the U.S. army for the potable water supply of one of its military bases.

These attacks have likely resulted in concrete infections in the oil industry. For example, in the fall of 2018, Trend Micro observed communications between a U.K.-based oil company with computer servers in the U.K. and India and an APT33 C&C server. 

Another European oil company suffered from an APT33 related malware infection on one of their servers in India for at least three weeks in November and December last year. There were several other companies in oil supply chains that had been compromised in the fall of 2018 as well. These compromises indicate a big risk to companies in the oil industry, as APT33 is known to use destructive malware.

NetApp Keystone program delivers simplified cloud participation for enterprise, both on and off the premises

NetApp announced on Tuesday NetApp Keystone, a program that offers a range of flexible solutions for customers whether they choose to build or buy their cloud infrastructure.

Organizations are digitally transforming to drive competitive advantage. They need to accelerate innovation in today’s real-time world while dealing with the complex reality that data and resources live anywhere and everywhere.

In order to address this complexity, IT environments must transform. While the industry has been focused on addressing these needs from a technology standpoint, the incremental improvements to financial options and to the upgrade process haven’t kept pace, until now.

NetApp Keystone is a program that offers a range of flexible solutions for customers, whether they choose to build or buy their cloud infrastructure, on their premises or off. Keystone offers the agility, pay-per-use economics, dynamic scaling, and operational simplicity that customers need to be able to consume cloud on their own terms.

Keystone features flexibility to mix and match purchases and subscription payment methods; ability to run any NetApp service in any environment—on premises, cloud, and hybrid; freedom to choose how it’s all managed—by NetApp, a partner, or internally; and simplified ownership experience that makes it easier to buy, operate and grow starting with NetApp’s new systems, the A400, FAS8300 and FAS8700.

Keystone is designed to meet the reality of a hybrid multicloud world where IT teams need to have greater choice, flexibility, and freedom to run and pay for their data services however they want.

NetApp aims to simplify the business of data services for customers from every perspective: from how they buy and consume products and services to how they run them in their environments and who services them. 

Along with the new program and simplified customer experience, NetApp announced a number of updates throughout its portfolio, with a range of new product launches, enhancements, and integrations.

The integrated solution with Active IQ and Cloud Insights offer access to NetApp’s exponentially growing data lake of IT infrastructure intelligence for real-time, one-click resolution of issues across an entire hybrid multi-cloud environment. New data services provide security and compliance for various industries, including federal, defense, and critical infrastructure, in addition to enterprise-class protection and tiering of cloud data, regardless of the choice of cloud.

The offering also delivers flash storage systems and solutions and NetApp ONTAP updates offer a range of performance options, simplicity to power enterprise and modern applications. Additionally, the AFF All SAN array delivers resiliency and record-setting performance in the midrange.

Leveraging Kubernetes, NetApp has created a redesigned model to allow true application portability and answer the economic factors and complexity concerns that have begun to plague modern DevOps. Based on NetApp’s own transformation, which connected the dots between three disparate solutions being used internally, it provides the template for anyone to avoid vendor lock-in, lift and shift entire infrastructures, with the flexibility around anywhere workloads live.