TrendLabs: More than a Dozen Obfuscated APT33 Botnets Used for Extreme Narrow Targeting

Figure 1. Schema showing the multiple obfuscation layers that APT33 uses

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/more-than-a-dozen-obfuscated-apt33-botnets-used-for-extreme-narrow-targeting/