🇨🇳

Calypso group

APT Group Information theft and espionage ETDA ✓

Also Known As 2 names

BRONZE MEDLEY Calypso

Target Countries 10

Countries highlighted in red

Afghanistan Brazil Belarus India Kyrgyzstan Kazakhstan Mongolia Thailand Turkey Ukraine

Sectors Targeted

Government

Details

Origin 🇨🇳 CN

Last Updated 01 Jun 2022

MITRE ATT&CK 6

T1059.001 T1071.001 T1078 T1105 T1114 T1574

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 2 entries

Calypso Positive Technologies

Bronze Medley SecureWorks

Observed Target Countries 11

Based on ETDA data — countries highlighted in red

Afghanistan Belarus Brazil India Kazakhstan Kyrgyzstan Mongolia Russia Thailand Turkey Ukraine

Description

(Positive Technologies) The PT Expert Security Center first took note of Calypso in March 2019 during threat hunting. Our specialists collected multiple samples of malware used by the group. They have also identified the organizations hit by the attackers, as well as the attackers’ C2 servers. Our data indicates that the group has been active since at least September 2016. The primary goal of the group is theft of confidential data. Main targets are governmental institutions in Brazil, India, Kazakhstan, Russia, Thailand, and Turkey. Our data gives reason to believe that the APT group is of Asian origin.

Tools Used 20

Byeby Calypso RAT DCSync DoublePulsar EarthWorm EternalBlue EternalRomance FlyingDutchman Hussar Mimikatz nbtscan netcat OS_Check_445 PlugX Quarks PwDump SysInternals TCP Port Scanner Whitebird ZXPortMap Living off the Land

Operations 2

2021-03 Exchange servers under siege from at least 10 APT groups https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/

2021-08 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan https://www.recordedfuture.com/chinese-APT-groups-target-afghan-telecommunications-firm/

Reports & References 1

https://www.ptsecurity.com/ww-en/analytics/calypso-apt-2019/

ETDA Profile

Calypso

Origin

China

First Seen 2016

Motivation

Information theft and espionage

View on ETDA APT Groups ↗