GINC Technology
GINC-APT-0116 · State

Calypso

Also Bronze Medley, Red Lamassu, Snail.

Category
State · Attributed to a state or working for one.
Origin
China(high confidence)
Motivation
Information theft and espionage
Seen
2016–2019
Status
Dormant
Sources
8 sources carry it
Identifier
GINC-APT-0116 · calypso

What it is

For the first time, the activity of the Calypso group was detected by specialists of PT Expert Security Center in March 2019, during the work to detect cyber threats. As a result, many malware samples of this group were obtained, affected organizations and control servers of intruders were identified. According to our data, the group has been active since at least September 2016. The main goal of the group is to steal confidential data, the main victims are government agencies from Brazil, India, Kazakhstan, Russia, Thailand, Turkey. Our data suggest that the group has Asian roots. Description translated from Russian.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

PwC
Red Lamassu
Other names
Bronze Medley, Snail

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
Afghanistan, Belarus, Brazil, India, Kazakhstan, Kyrgyzstan, Mongolia, Russia, Thailand, Türkiye, Ukraine
Sectors
Government, Government, Administration

Tools

The tools and malware families the sources tie to it.

  • Byeby
  • Calypso RAT
  • Cyber Eye RAT
  • CyberGate
  • DCSync
  • DoublePulsar
  • EarthWorm
  • EternalBlue
  • EternalRomance
  • FlyingDutchman
  • Hussar
  • Living off the Land
  • Mimikatz
  • OS_Check_445
  • PlugX
  • Quarks PwDump
  • RIPTIDE
  • SysInternals
  • TCP Port Scanner
  • Whitebird
  • Xpert
  • ZXPortMap
  • nbtscan
  • netcat

Sources