Calypso APT Emerges from the Shadows to Target Governments

guest · Oct 31, 2019

Calypso APT Emerges from the Shadows to Target Governments
Researchers believe the threat group is based in China
October 31, 2019
https://threatpost.com/calypso-apt-target-governments/149773/

A newly discovered APT group, dubbed Calypso after a custom malware RAT that it uses, has been targeting state institutions in six different countries since 2016.

Government organizations in India (34 percent), Brazil and Kazakhstan (18 percent respectively), Russia and Thailand (12 percent respectively) and Turkey (6 percent) have all been successfully infiltrated at some point, according to analysts at Positive Technologies (PT), which first spotted the group in March.

To that point, the typical modus operandi of the threat actors consists of infiltrating the network perimeter by exploiting a Windows SMB remote code-execution vulnerability (CVE-2017-0143) or by using stolen credentials.
Once inside the network, the group injects a backdoor RAT program – the Calypso web shell – that it uses to execute commands and upload utilities and malware (including well-known tools like Mimikatz, and the NSA hacking tools EternalBlue and EternalRomance), all in an effort to move laterally.
Click to expand...

“These attacks succeeded largely because most of the utilities the group uses to move inside the network are widely used by the specialists everywhere for network administration,” said Denis Kuvshinov, lead specialist in threat analysis at Positive Technologies, via email. “The group used publicly available utilities and exploit tools.”

“The group has several successful hacks to its credit, but still makes mistakes allowing us to guess its origins,” PT concluded. “All data given here suggests that the group originates from Asia and uses malware not previously described by anyone…We keep monitoring the activities of Calypso closely and expect the group will attack again.”
Click to expand...

Positive Technologies: Positive Technologies Investigation: New APT Group Attacks Multiple State Institutions
Full Positive Technologies report on Calypso APT: Calypso APT: new group attacking state institutions

Log in or Sign up

Calypso APT Emerges from the Shadows to Target Governments

guest Guest

Log in or Sign up

Calypso APT Emerges from the Shadows to Target Governments

guest Guest

Useful Searches