A sophisticated cyber espionage campaign by Chinese hackers targeting telecom networks leverages a new malware dubbed Showboat or kworker, primarily targeting the Linux operating system, but with a Windows variant.
Active since 2022, the previously unreported strain is frequently used in post-exploitation frameworks used by at least one threat actor, including those aligned with the People’s Republic of China (PRC).
According to researchers at Black Lotus Labs who partnered with PricewaterhouseCoopers (PwC) Cyber Threat Intelligence Team, the cyber espionage campaign is associated with Chinese threat actors Red Lamassu, also known as Calypso.
“We believe this is the first public reporting of this toolset, one which highlights the persistent targeting of Linux-based systems as access vectors to move deeper into networks,” the researchers stated.
New Showboat malware used in Chinese cyber espionage
Researchers at Black Lotus Labs say they uncovered evidence that the malware strain was used in a cyber espionage campaign targeting a telecommunication provider in the Middle East and impersonating another in Southeast Asia. The attackers set telecom-themed websites to impersonate target telecom providers, such as singtelcom[.]site and kaztelecom[.]shop.
Further analysis of the malware revealed advanced features, including the ability to hide from system administrators, transfer files, interact with machines hidden deep in the network, and act as a SOCKS5 proxy.
“One notable feature is the ‘hide’ command, which enables a process to conceal itself on a host machine by retrieving code stored on external websites such as Pastebin or online forums for use as a ‘dead drop,’” the researchers explained.
Similarly, using the SOCKS5 and portmap protocols allows the malware to act as a foothold, enabling threat actors behind the cyber espionage campaign to interact with machines that are not exposed to the internet but are only accessible on the LAN.
“The presence of these two functions indicates that the purpose of Showboat is to function as a foothold,” they explained.
Once deployed, the malware collects system information, such as the hostname, operating system, list of running processes, the agent process, and a desktop screenshot, and sends them to its command-and-control (C2) server, located on IP addresses in Chengdu, Sichuan Province, China.
Black Lotus Labs researchers found multiple clusters targeting dissimilar targets across regions, including the Donbas region of Ukraine, suggesting that the threat actor was distributing the malware.
“If your reaction to this news is – oh, another one – you are right to feel that way,” Evan Powell, Founding CEO, DeepTempo. “The pace at which successful attacks are occurring is indeed accelerating. At today’s National Cybersecurity Forum at the Capitol in Washington, D.C., multiple experts and policy leaders pointed out that static responses, such as more patching or better rules, cannot help us precisely because the adversaries are becoming much more prevalent, more intelligent, and are moving faster.”
“Today’s defenses were built in an age of human speed defense and response; the attackers have changed the game and we must replatform cybersecurity to be able to address the flood of ever more pervasive and intelligent attacks,” added Powell.
Showboat/kworker malware Windows variant is just as potent
PricewaterhouseCoopers Cyber Threat Intelligence Team detailed a Windows variant of the Showboat/kworker malware variant used in the Chinese cyber espionage.
Dubbed JFMBackdoor, the malware begins execution via a batch script that deploys the main payload via DLL sideloading.
Like its Linux counterpart, JFMBackdoor packs sophisticated features for cyber espionage. They include remote shell access for remote code execution (RCE), enabling threat actors to control the host system.
Other functions include file system operations for downloading, uploading, and deleting files; network proxying; and process and service management to create, start, stop, and kill processes and services; and network reconnaissance for device discovery.
The Windows variant can also perform registry manipulation, capture screenshots, enable self-management to hide its activity, and manage configuration settings.
Additionally, the Windows variant embeds various C2 domains hidden behind the content distribution network (CDN) Cloudflare to prevent potential blacklisting.
According to PwC researchers, DLL analysis determined that it targets various Asian countries, including Afghanistan, Kazakhstan, Thailand, and India. PwC also asserts that the target list aligns with Red Lamassu’s cyber espionage activities.
