Adversary Intelligence — 2026-06-01

China-Based Red Lamassu APT Group Targets Telecoms Across Central and South Asia With JFMBackdoor

BLUFRed Lamassu's confirmed foothold in Afghan telecom infrastructure and domain spoofing of Kazakhtelecom and Singtel point to a sustained PRC signals collection campaign spanning Central and South Asia.

PwC Threat Intelligence discovered the campaign through a misconfigured open directory hosted on 23.27.201[.]160, active between July and October 2025, containing the full JFMBackdoor infection chain alongside the Linux implant Lumen's Black Lotus Labs calls Showboat 12. JFMBackdoor arrives via DLL side-loading and communicates with C2 domain namefuture[.]site, supporting remote shell, file operations, network proxying, screenshot capture, and self-removal 1. PwC identified multiple artifacts tying the intrusion to an Afghan telecommunications provider, including a DLL uploaded to a public malware scanner by a local user and TLS certificates linked to an Afghan telecom domain controller 1. Black Lotus Labs independently characterizes Showboat as a modular SOCKS5 proxy and port-forwarding framework whose concealment routine dead-drops hiding code from Pastebin and online forums rather than embedding it, and documents dwell time of at least three years inside a Middle Eastern telecom. BankInfoSecurity reports the campaign has operated since at least mid-2022, with attacker-controlled domains impersonating Kazakhtelecom and Singapore's Singtel identified among the indicators of compromise 2.

Analysis
Red Lamassu's confirmed access to Afghan telecommunications infrastructure establishes a persistent collection platform for voice and data transiting a strategically positioned Central Asian hub. A July–October 2025 open directory exposure on an attacker-controlled server revealed the complete JFMBackdoor infection chain alongside the Showboat Linux implant. The tooling overlaps with at least one other tracked PRC-aligned cluster, indicating shared contractor infrastructure rather than bespoke development. Domain impersonation of Kazakhtelecom and Singtel extends the campaign's geographic footprint beyond confirmed Afghan access into Kazakhstan and Singapore. That shared tooling base raises the possibility that some Red Lamassu-attributed intrusions were conducted by distinct actors drawing on common PRC contractor infrastructure.

4 sources

Open Directory, Open Season: Inside Red Lamassu's JFMBackdoor - PwC Threat Intelligence
New Telecom Espionage Campaign Tied to China - BankInfoSecurity
China-Based Red Lamassu Targets Telecoms Across Asia - Security Online
Introducing Showboat: A new malware family taunts defenses and targets international telecom firms - Black Lotus Labs (Lumen Technologies)