Calypso

Calypso is a notable threat actor group, potentially linked to the Chinese state-sponsored threat actor group APT41, alongside other groups such as Hafnium, LuckyMouse, Tick, and Winnti Group. This group has been involved in various cyber espionage campaigns using sophisticated tools like Win32/Korplug.RU, Win32/Korplug.RT, and Win32/Agent.ACUS as loaders for their malware. Calypso also employs the use of Command & Control (C&C) servers, including rawfuns[.]com and yolkish[.]com, to manage their malicious operations. In 2019, Positive Technology Security reported on Calypso's use of the Remote Access Trojan (RAT) dubbed "Calypso RAT". Additionally, Calypso has been known to use an exclusive version of the shellcode-formed in-memory modular backdoor, Win.NOODLERAT. Originally reported by NCC Group and Positive Technology Security, Win.NOODLERAT has been used by several threat actors, including Iron Tiger, Calypso APT, and other unknown clusters in their espionage campaigns. However, it's important not to confuse this threat actor with Calypso AI, a separate entity that is a leader in security in AI. Founded by Neil Serebryany, Calypso AI focuses on scoring vulnerabilities at the point of model prompts and their responses, either logging or blocking them. The Berryville Institute of Machine Learning (BIML) recently attended Calypso AI’s Accelerate AI 2023 conference in Washington, DC, indicating its industry recognition and influence.