Open Directory, Open Season: Inside Red Lamassu’s JFMBackdoor

Executive summary

PwC Threat Intelligence has been tracking a China-based threat actor we call Red Lamassu (a.k.a. Calypso) since 2019, observing its operations targeting telecommunications and government entities across the Asia Pacific region with a combination of bespoke and shared tooling. This blog is released in tandem with Lumen’s Black Lotus Labs, who detail one portion of Red Lamassu’s operations (an ELF binary we respectively call kworker or Showboat), whilst we focus on the Windows-oriented elements of its operations.

Our analysis revolves around an open directory found during our hunting of Red Lamassu, containing both an aforementioned kworker sa…