Executive Summary
PwC Threat Intelligence has identified a campaign by Red Lamassu (also known as Calypso), a China-based threat actor likely operating from Sichuan Province. The group has been active since at least 2019, primarily targeting telecommunications and government sectors across the Asia-Pacific region, including Kazakhstan, Afghanistan, and India. The actor utilizes an open directory infrastructure to host a multi-stage infection chain involving both Linux-based malware (Showboat/kworker) and a sophisticated Windows backdoor named JFMBackdoor.
The attack chain typically begins with a batch script that downloads several components to the %TEMP% directory. It leverages DLL side-loading via a legitimate executable (fltMC.exe) to load JFMBackdoor, which provides extensive remote access, file system manipulation, and data exfiltration capabilities. Recent activity indicates a strong focus on Afghan telecommunications, corroborated by the discovery of actor-controlled infrastructure linked to Afghan government and ISP certificates.
This campaign represents a persistent threat to regional critical infrastructure. The use of bespoke backdoors like JFMBackdoor, combined with shared tooling like PlugX and Linux-based tamers, demonstrates the group's investment in long-term intelligence collection and anti-forensic techniques such as self-removal and memory-only execution.