Chinese Calypso APT Uses Showboat Linux Backdoor on Telecoms

The article discusses recent findings regarding Chinese state-aligned hackers utilizing a Linux backdoor malware framework named "Showboat" to spy on telecommunications companies in Central Asia. The malware has been observed being used by the Chinese APT group Calypso since at least 2019. Showboat allows for network infiltration, affecting devices on local area networks, particularly in regions with less mature cybersecurity measures.

Black Lotus Labs indicated that despite its unexceptional capabilities compared to advanced malware, its simplicity may contribute to its effectiveness in achieving espionage objectives without detection. Researchers speculate that China tests malware in smaller markets to gauge effectiveness before targeting significant assets.