Lumen Black Lotus Labs Exposes Chinese Showboat Malware Family Targeting Middle East Telecom Providers Since 2022

Lumen Black Lotus Labs on May 21 disclosed Showboat, a previously unreported Linux malware framework targeting telecommunications providers since at least mid-2022, with remote shell access, file transfer, and SOCKS5 proxy capabilities; the malware registered zero detections on VirusTotal when first submitted and reportedly remained undetected through April 2026 12. Black Lotus correlated C2 nodes to Chengdu-geolocated IP addresses, including one resolving to China Unicom, and attributed the tooling to at least one, and likely several, PRC-aligned clusters observed sharing the tool across dissimilar targets; The Hacker News and BleepingComputer identify Calypso, also tracked as Red Lamassu and assessed as likely operating out of Sichuan Province, as one such actor 123. Confirmed victims include an Afghanistan-based ISP and an Azerbaijani entity, with secondary C2 analysis surfacing possible compromises in the United States and Ukraine 12. PwC Threat Intelligence, in a coordinated release with Black Lotus, documented a companion Windows implant called JFMBackdoor deployed via DLL side-loading against telecommunications targets in Afghanistan, with capabilities including remote shell, file system operations, network proxying, screenshot capture, and self-removal 234.