Calypso

Also known as: BRONZE MEDLEY, Bronze Medley, Calypso, Red Lamassu, Snail

For the first time, the activity of the Calypso group was detected by specialists of PT Expert Security Center in March 2019, during the work to detect cyber threats. As a result, many malware samples of this group were obtained, affected organizations and control servers of intruders were identified. According to our data, the group has been active since at least September 2016. The main goal of the group is to steal confidential data, the main victims are government agencies from Brazil, India, Kazakhstan, Russia, Thailand, Turkey. Our data suggest that the group has Asian roots. Description translated from Russian.

🌍 Country China
📅 Activity 2019 — 2019
Government, Administration
2019
2019

Associated Operations

2021-03 2021-08 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan Exchange servers under siege from at least 10 APT groups https://www.recordedfuture.com/chinese-APT-groups-target-afghan-telecommunications-firm/ https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/

Introduction

For the first time, the activity of the Calypso group was detected by specialists of PT Expert Security Center in March 2019, during the work to detect cyber threats. As a result, many malware samples of this group were obtained, affected organizations and control servers of intruders were identified. According to our data, the group has been active since at least September 2016. The main goal of the group is to steal confidential data, the main victims are government agencies from Brazil, India, Kazakhstan, Russia, Thailand, Turkey. Our data suggest that the group has Asian roots. Description translated from Russian.

Activities and Tactics

Targeted Sectors: Government, Administration

Country of Origin: 🇨🇳 China

First Seen: 2019

Last Activity: 2019

Notable Campaigns

  • 2021-03
  • 2021-08
  • 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan
  • Exchange servers under siege from at least 10 APT groups
  • https://www.recordedfuture.com/chinese-APT-groups-target-afghan-telecommunications-firm/
  • https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • RIPTIDE
  • CyberGate
  • Cyber Eye RAT
  • Xpert
  • Byeby:
  • Calypso RAT:
  • DCSync:
  • DoublePulsar:
  • EarthWorm:
  • EternalBlue:
  • EternalRomance:
  • FlyingDutchman:
  • Hussar:
  • Living off the Land:
  • Mimikatz:
  • OS_Check_445:
  • PlugX:
  • Quarks PwDump:
  • SysInternals:
  • TCP Port Scanner:
  • Whitebird:
  • ZXPortMap:
  • nbtscan:
  • netcat:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.