🇨🇳

Calypso

APT Group Information theft and espionage 4 zero-day CVEs ETDA ✓

Also Known As 3 names

Calypso Bronze Medley BRONZE MEDLEY

Target Countries 11

Countries highlighted in red

Afghanistan Brazil Canada Egypt India Kazakhstan Russian Federation Thailand Turkey Ukraine United States

Sectors Targeted

Finance and Insurance 52 Computer Systems Design and Related Services 54151 NAICS:31 31 Professional, Scientific, and Technical Services 54 Software Publishers 5112 Public Administration 92 Information 51 Space Research and Technology 927 Telecommunications 517

Details

Origin 🇨🇳 CN

Last Updated 23 Jul 2022

MITRE ATT&CK 11

T1059 T1059.001 T1071.001 T1078.003 T1105 T1140 T1195 T1218 T1547 T1566.001 T1573

Related Zero-Days 4

CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065

Known Names 2 entries

Calypso Positive Technologies

Bronze Medley SecureWorks

Observed Target Countries 11

Based on ETDA data — countries highlighted in red

Afghanistan Belarus Brazil India Kazakhstan Kyrgyzstan Mongolia Russia Thailand Turkey Ukraine

Description

(Positive Technologies) The PT Expert Security Center first took note of Calypso in March 2019 during threat hunting. Our specialists collected multiple samples of malware used by the group. They have also identified the organizations hit by the attackers, as well as the attackers’ C2 servers. Our data indicates that the group has been active since at least September 2016. The primary goal of the group is theft of confidential data. Main targets are governmental institutions in Brazil, India, Kazakhstan, Russia, Thailand, and Turkey. Our data gives reason to believe that the APT group is of Asian origin.

Tools Used 20

Byeby Calypso RAT DCSync DoublePulsar EarthWorm EternalBlue EternalRomance FlyingDutchman Hussar Mimikatz nbtscan netcat OS_Check_445 PlugX Quarks PwDump SysInternals TCP Port Scanner Whitebird ZXPortMap Living off the Land

Operations 2

2021-03 Exchange servers under siege from at least 10 APT groups https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/

2021-08 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan https://www.recordedfuture.com/chinese-APT-groups-target-afghan-telecommunications-firm/

Reports & References 1

https://www.ptsecurity.com/ww-en/analytics/calypso-apt-2019/

ETDA Profile

Calypso

Origin

China

First Seen 2016

Motivation

Information theft and espionage

View on ETDA APT Groups ↗