APT33 has been detected modifying registry keys and creating a new service named 'WinSecureService' to maintain the persistence of wiper malware across system reboots. The modification involved adding autorun registry entries and creating a service linked to the malicious binary 'wiper.exe'.