# Calypso (Red Lamassu) China-Nexus Telco Espionage — Showboat Linux SOCKS5 Backdoor + JFMBackdoor Windows Implant

> Lumen Black Lotus Labs and PwC Threat Intelligence disclosed an active Chinese cyber-espionage campaign attributed to Calypso (aka Red Lamassu) targeting telecommunications providers in Asia Pacific and the Middle East since at least mid-2022. Operators deploy Showboat — a modular Linux post-exploitation framework with SOCKS5 proxy, port-forwarding, process hiding, and Pastebin dead-drop tasking — alongside JFMBackdoor, a full-featured Windows espionage implant loaded via fltMC.exe + FLTLIB.dll DLL sideloading. Confirmed victims include an Afghan ISP and an Azerbaijani entity, with a secondary C2 cluster sharing X.509 certificates implicating compromises in the United States and Ukraine.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0549
- **ID:** TL-2026-0549
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Calypso (China)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OVERVIEW

On 2026-05-21, Lumen Black Lotus Labs and PwC Threat Intelligence jointly disclosed a multi-year Chinese cyber-espionage campaign attributed to the Calypso threat group (tracked by PwC as Red Lamassu). The campaign targets telecommunications carriers and internet service providers across Asia Pacific and the Middle East, leveraging two previously undocumented implants — Showboat (Linux) and JFMBackdoor (Windows) — together with telecom-themed impersonation domains. Black Lotus Labs assesses with moderate-to-high confidence that the tooling is operated by at least one — and likely several — China-aligned activity clusters, with C2 infrastructure correlating to IP geolocations in Chengdu, Sichuan Province, China. Kaspersky tracks an overlapping Linux artifact as EvaRAT, and the toolset shows infrastructure-pattern overlap with PlugX, ShadowPad, and NosyDoor operators.

SHOWBOAT LINUX FRAMEWORK

Showboat (file basename frequently masquerades as kworker, a legitimate Linux kernel thread name) is a modular ELF post-exploitation framework purpose-built for long-term persistence on carrier-grade Linux infrastructure. Capabilities documented across Black Lotus Labs telemetry:

- Host reconnaissance: enumerates kernel version, distribution, network interfaces, running processes, and open ports.
- Remote interactive shell: PTY-backed reverse shell with command execution.
- File operations: upload, download, deletion, timestomping.
- SOCKS5 proxy: full RFC 1928 implementation allowing operators to tunnel arbitrary TCP through the compromised host into otherwise unroutable carrier networks.
- TCP port-forwarding: bidirectional relays for lateral movement between segmented subnets.
- Network scanner: discovers reachable hosts and integrates results with the SOCKS5 module for pivoting into adjacent network segments not directly reachable from the operator.
- Process concealment ('hide' command): retrieves obfuscation/rootkit-style hiding code from external dead-drop locations — most notably a Pastebin paste registered 2022-01-11 — and applies it to conceal Showboat's process from /proc enumeration and process listing tools.
- Multi-C2 management: stores a list of primary and fallback C2 endpoints; rotates on failure.
- Persistence: installs as a systemd service or sysvinit script under names mimicking legitimate kernel workers (kworker, kthreadd, kauditd).
- Beaconing channel: exfiltrates host-survey data as encrypted, Base64-encoded blobs hidden inside PNG image fields posted to attacker-controlled servers, evading mime/extension-based egress filtering.

A pivotal sample (SHA256 d6a4fad5448838dbc8cc6b33f1dbfbdc7a2fad36de58ff6a66dce96f729f7011) was first uploaded to VirusTotal in May 2025 from an unattributed submitter, allowing Black Lotus Labs to retroactively scope the campaign back to mid-2022.

JFMBACKDOOR WINDOWS IMPLANT

PwC's analysis of the Windows infection chain shows Red Lamassu staging JFMBackdoor through a multi-step DLL sideloading sequence:

1. A batch script (delivered post-initial-access) drops three files into a user-writable directory: the legitimate Microsoft-signed fltMC.exe (Filter Manager Control utility), a trojanized FLTLIB.dll proxy DLL, and an encrypted JFMBackdoor payload.
2. The batch script executes fltMC.exe, which lazy-loads FLTLIB.dll from its working directory (Windows default search-order hijack — MITRE T1574.001).
3. The malicious FLTLIB.dll decrypts and reflectively loads the final JFMBackdoor stage into the trusted fltMC.exe process.

JFMBackdoor capabilities:

- Reverse shell access.
- File management (read/write/delete/list, recursive directory enumeration).
- TCP proxying for lateral movement.
- Process and service control (enumerate, kill, create, start, stop).
- Registry manipulation (read/write/delete keys and values).
- Screen capture.
- Encrypted configuration management — C2 endpoints, beacon intervals, and module enablement stored in an encrypted blob refreshed on demand.
- Self-removal and anti-forensics — wipes its dropped artifacts, clears prefetch traces, and tampers with USN journal entries on command.

INFRASTRUCTURE AND ATTRIBUTION

Red Lamassu/Calypso operators register telecom-themed impersonation domains that mimic carriers and managed-service providers in the targeted regions, supporting both initial access pretexting and C2 traffic blending. Black Lotus Labs identified a secondary C2 cluster reusing X.509 certificate generation patterns (matching CN/O fields, fixed serial-number prefixes, and shared key-generation entropy) — the cluster expands victimology to at least two probable compromises in the United States and one in Ukraine. Geographic IP correlation against multiple primary C2 nodes places operator activity in Chengdu, Sichuan, China — historically a hub for MSS-aligned offensive cyber operations. PwC assesses Red Lamassu's tooling and tradecraft as overlapping with — but distinct from — PlugX, ShadowPad, and NosyDoor operator clusters, consistent with the broader Chinese state-aligned 'shared digital quartermaster' model in which custom and commodity implants flow between contractor groups serving the MSS.

IMPACT AND SECTOR EXPOSURE

The campaign focuses on the strategic intelligence value of telecommunications providers: lawful intercept platforms, signaling gateways, subscriber databases, roaming partner exchanges, and the SS7/Diameter cores that route subscriber metadata for partner carriers worldwide. A compromised mid-tier carrier is therefore an upstream vantage point onto subscribers of dozens of partner networks, which is consistent with the strategic ROI sought by Chinese intelligence services. The SOCKS5/port-forward design of Showboat is operationally tuned to bridge from the public-facing telecom Linux estate into management VLANs, OSS/BSS systems, and ultimately the operator's Active Directory forest — where JFMBackdoor takes over.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1543 Create or Modify System Process
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1057 Process Discovery
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1090 Proxy
- T1113 Screen Capture
- T1005 Data from Local System
- T1102 Web Service
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Chinese hackers target telcos with new Linux, Windows malware](https://www.bleepingcomputer.com/news/security/chinese-hackers-target-telcos-with-new-linux-windows-malware/)
- [Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor](https://thehackernews.com/2026/05/showboat-linux-malware-hits-middle-east.html)
- [Black Lotus Labs — Public IOC Repository](https://github.com/blacklotuslabs/IOCs)
- [Black Lotus Labs — Lumen Technologies (research hub)](https://www.lumen.com/en-us/security/black-lotus-labs.html)
- [HijackLibs — fltlib.dll DLL hijack entry](https://hijacklibs.net/entries/microsoft/built-in/fltlib.html)
- [Suspected Chinese Group Calypso APT Exploiting Vulnerable Microsoft Exchange Servers](https://www.recordedfuture.com/research/chinese-group-calypso-exploiting-microsoft-exchange)
- [MITRE ATT&CK T1574.001 — DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0549