TEMP.Periscope
Attribution profile
- Type
- Nation State
- Location
- China
- Known incidents
- 17 incidents
- Sources
- 7 sources
- First seen
- 2017-01-01
- Last seen
- 2020-07-01
- Updated
- 2026-10-15 01:30
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
TEMP.Periscope, also known as Calypso APT and Mudcarp, is a Chinese state‑sponsored threat actor operating from Hainan, China. The group primarily conducts espionage, seeking political and strategic intelligence from targets in Southeast Asia, the United States, and other regions. Its targeting includes maritime and engineering firms, defense contractors, government offices, research universities, high‑tech and healthcare sectors, as well as Cambodian governmental bodies, opposition figures, NGOs and media organizations, and Afghan telecommunications providers. Observed tactics involve spear‑phishing with malicious decoy documents, watering‑hole attacks, misuse of Foxmail clients and Responder tools to harvest SMB credentials via malicious file:// paths, NBT‑NS poisoning, and the use of exploits such as ETERNALBLUE and DNS tunneling. Malware families associated with the group include Winnti, PlugX, AIRBREAK, EVILTECH, DADBOD, HOMEFRY, MURKYTOP, HTRAN, and SCANBOX, together with credential‑stealing tools and JavaScript‑based backdoors. The group’s infrastructure shows Chinese language settings and login IPs traced to Hainan, supporting assessments by firms such as FireEye and Recorded Future that it works on behalf of the Chinese state. Representative campaigns cited in open sources are the 2018 intrusion against Cambodian election bodies and related NGOs, the 2020 mail‑server compromise of Afghanistan’s Roshan telecommunications provider, and a 2018 spear‑phishing operation against a UK‑based engineering firm that reused techniques seen in Russian APT groups.
Incidents
Attributed incidents are available to members.
17 incidentsSources
Sources available to members: 7 sources.