Calypso__2019__calypso-apt-2019-rus.pdf

Positive Technologies technical analysis of the Calypso APT: an advanced actor active since at least 2016 targeting government organizations across multiple countries. The report details initial access via ASPX web shells, lateral movement (Mimikatz, MS17-010/EternalBlue/DoublePulsar), multiple custom payloads (Calypso RAT, stagers, droppers, Hussar, FlyingDutchman), module architecture and network protocol/RC4-based encryption, provides extensive IOCs (IPs, domains, hashes) and maps observed behaviors to MITRE ATT&CK.