cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Researchers Detail Calypso-Linked Telecom Espionage Campaign Using Showboat and JFMBackdoor

· Original article ↗

Summary

Lumen and PwC researchers describe a Calypso-attributed campaign targeting telecom providers in Asia Pacific and the Middle East since at least mid-2022, using Linux Showboat and Windows JFMBackdoor implants. The initial infection vector is unknown.

Key points

  • Researchers attribute the campaign to Calypso, also tracked as Red Lamassu; it has targeted telecommunications providers since at least mid-2022.
  • Showboat is a modular Linux implant that collects host information, supports persistence, transfers files, hides processes, and can provide SOCKS5 proxying and port forwarding.
  • The initial infection vector for Showboat is unknown.
  • The Windows infection chain uses a batch script to stage DLL sideloading involving fltMC.exe and FLTLIB.dll before loading JFMBackdoor.
  • JFMBackdoor supports remote command execution, file and process management, TCP proxying, registry changes, screenshots, and anti-forensics.
  • Researchers observed telecom-themed domains used to impersonate targets and infrastructure shared across multiple clusters; Lumen says the tooling is likely shared among China-aligned groups.

Article Details

Attack Vectors
  • The initial infection vector is unknown.
  • On Windows, a batch script drops payloads that stage DLL sideloading using fltMC.exe and FLTLIB.dll before loading the backdoor.
  • The threat actors used multiple telecom-themed domains to impersonate targets; the article does not provide the domain values.

MITRE ATT&CK

T1059.003 · Windows Command ShellThe Windows infection chain begins with execution of a batch script that drops payloads.T1070.004 · File DeletionJFMBackdoor can delete traces as part of its self-removal and anti-forensics capabilities.T1090.001 · Internal ProxyShowboat and JFMBackdoor can use compromised systems as proxies or relays into internal systems.T1102.001 · Dead Drop ResolverShowboat's hide command retrieves code stored on external websites such as Pastebin or online forums for use as a dead drop.T1112 · Modify RegistryJFMBackdoor can modify Windows registry keys and values.T1113 · Screen CaptureJFMBackdoor can capture screenshots of the victim's desktop.T1543 · Create or Modify System ProcessShowboat can establish persistence by creating a new service on a Linux host; the article does not specify the service type.T1574.002 · DLL Side-LoadingThe Windows payload chain stages DLL sideloading using fltMC.exe and FLTLIB.dll.

Threat Actors

CalypsoThe campaign targeting telecommunications providers is attributed to Calypso; the article says the operation has been active since at least mid-2022.

Malware

JFMBackdoorThe operation uses Showboat and JFMBackdoor to enable persistence, espionage, proxying, and internal network movement across compromised systems.ShowboatThe operation uses Showboat and JFMBackdoor to enable persistence, espionage, proxying, and internal network movement across compromised systems.

Countries

ChinaLumen concludes that the tooling is likely shared across multiple China-aligned threat groups, each targeting different regions and using the same malware ecosystem.

Industries

TelecommunicationsA Chinese cyber-espionage campaign attributed to Calypso, also known as Red Lamassu, has been targeting telecommunications providers in Asia Pacific and the Middle East with newly discovered Linux and Windows malware.