Executive Summary
Since mid-2022, a Chinese cyber-espionage campaign attributed to Calypso (also known as Red Lamassu) has been targeting telecommunications providers across the Asia Pacific and Middle East. The campaign utilizes a dual-platform approach, deploying the 'Showboat' modular framework on Linux systems and the 'JFMBackdoor' on Windows environments to establish persistent footholds within critical infrastructure.
Technically, the attackers utilize sophisticated persistence and evasion techniques, including DLL sideloading on Windows and the use of 'dead drop' resolvers like Pastebin for Linux implants. Both malware families provide extensive command-and-control capabilities, including reverse shells, file manipulation, and SOCKS5 proxying, which facilitates lateral movement throughout the victim's internal network.
The targeting of telecommunications providers suggests a high-stakes intelligence gathering mission aimed at intercepting communications or monitoring network traffic. The use of decentralized infrastructure and shared tooling across China-aligned groups indicates a mature, coordinated operational ecosystem that poses a significant risk to regional service providers.