Calypso

Calypso is a recognized threat actor, likely linked to the Chinese state-sponsored group APT41. Other groups possibly connected to this network include Hafnium, LuckyMouse, Tick, Calypso, and Winnti Group (tracked by X-Force as Hive0088). Calypso has been associated with various malicious activities, including the use of Command and Control (C&C) servers like rawfuns[.]com and yolkish[.]com. The group uses specific loaders such as EB8D39CE08B32A07B7D847F6C29F4471CD8264F2 and 30DD3076EC9ABB13C15053234C436406B88FB2B9 for the Win32/Korplug malware, and 4F0EA31A363CFE0D2BBB4A0B4C5D558A87D8683E for the Win32/Agent malware. In 2019, Positive Technology Security released a report detailing the use of Calypso RAT (Remote Access Trojan) by the Calypso Advanced Persistent Threat (APT) group. Another tool exclusively used by Calypso APT is the Win.NOODLERAT, an in-memory modular backdoor, originally reported by NCC Group and Positive Technology Security. This backdoor has been deployed in espionage campaigns not only by Calypso APT but also by Iron Tiger and several unidentified clusters. However, it's important to note that "Calypso" is also the name of a leading company in AI security, Calypso AI, founded by Neil Serebryany. This organization focuses on scoring vulnerabilities at the point of model prompts and their responses, either logging or blocking these potential threats. Calypso AI is unrelated to the Calypso APT group, and its work was recently showcased at the Accelerate AI 2023 conference in Washington, DC, hosted by the Berryville Institute of Machine Learning (BIML).