China-aligned hackers built malware that turns telecom Linux servers into SOCKS5 proxies

Chinese threat actors have been quietly compromising telecommunications providers across the Asia Pacific and the Middle East since at least 2022, and the tools they use are unusually well-suited to the kind of long-haul infrastructure spying you'd expect from a state-aligned group. Researchers at Lumen's Black Lotus Labs and PwC Threat Intelligence published details today of two new implants — Showboat for Linux and JFMBackdoor for Windows — that the Calypso (AKA Red Lamassu) group has been using to turn compromised telco systems into network pivots.

Showboat is a modular post-exploitation framework that runs on Linux servers and does the kind of thing that makes sysadmins nervous: it collects host information, maintains persistence through new services, and then opens a SOCKS5 proxy on the compromised machine so attackers can hop deeper into the internal network. It also has a neat trick — a "hide" command that pulls code from dead drops like Pastebin pages, meaning the malware doesn't need to hard-code its C2 infrastructure. JFMBackdoor on Windows is equally featureful, with reverse shell access, screenshot capture, registry manipulation, and encrypted configuration management. Both tools use TCP proxying to turn the victim machine into a relay for further internal recon.

Source image 1

What's interesting here isn't just the malware — it's the operational model. Lumen's analysis shows a partially decentralized structure where multiple clusters share certificate-generation patterns and tooling but target distinct victim sets. The conclusion is that tooling is likely shared across multiple China-aligned threat groups, each handling different regions. For anyone running Linux in telecom or critical infrastructure, this is a reminder that the malware landscape isn't just Windows anymore. Showboat's approach — modular, persistence-focused, and network-relay oriented —

Source image 2

is something you'd want to see in your monitoring. If you're managing Linux endpoints that talk to the wider network, you're probably already looking at this. The question is whether your detection rules catch a SOCKS5 proxy masquerading as a legitimate service, or whether you only notice when something else goes wrong.