【CyCraft Monthly Intelligence】New Linux Malware “Showboat” Hits the Telecom Industry: Technical Analysis and Mitigation Guide

‍

Threat and Impact

Showboat is a newly uncovered Linux malware family that threat actors leverage to conduct long-term campaigns against telecommunications organizations. According to Lumen’s Black Lotus Labs, this malware has likely been active since mid-2022 and is assessed to be in use by at least one (and potentially multiple) China-related threat actors. Rather than being a simple, single-use implant, Showboat is a modular, post-exploitation framework designed specifically to maintain persistent access on compromised Linux systems and facilitate deeper network penetration.

This campaign poses a significant threat to the industry. As the core infrastructure delivering voice, data, and digital services to governments, enterprises, and consumers, telecommunications and satellite providers are high-value targets. A successful breach grants attackers privileged network access and lateral movement opportunities, providing deep insights into broader supply chains and interconnected dependencies. Even if the immediate victims are confined to specific countries, the highly interconnected nature of upstream and downstream telecom networks means the associated risks can easily expand to other nations.

Lumen's report notes that a telecommunications provider in the Middle East is affected, alongside observations of malicious infrastructure masquerading as local telecom companies in Southeast Asia. Telemetry data also reveals confirmed or suspected victim activity involving an Afghan ISP, an organization in Azerbaijan, and other potential compromises linked to various infrastructure clusters.

While no specific operational or service disruptions have been publicly confirmed, the presence of Showboat on telecom-related Linux systems should be treated as a severe warning. Showboat is a malware framework engineered specifically for long-term persistence, stealth, and traffic proxying within telecom environments. It serves as a foundation for sustained espionage campaigns, secondary intrusions, and prolonged unauthorized access to critical internal systems.

‍

Analyst Perspective

This case validates a broader trend in nation-associated cyber operations: threat actors are increasingly targeting Linux systems and infrastructure to establish a persistent foothold, particularly in areas where endpoint visibility is weaker than in traditional Windows environments. In this instance, the malware’s capabilities—including remote access, file transfers, persistence, process hiding, and proxying—indicate that the operators' primary focus is on long-term access and follow-on operations rather than immediate destruction. For defenders, this campaign underscores the strategic interest in telecom infrastructure and exposes a security gap resulting from insufficient visibility into Linux servers, routers, and East-West network traffic.

‍

Technical Details

Showboat is a newly uncovered Linux post-exploitation framework leveraged by threat actors to maintain persistent access, analyze compromised hosts, and pivot deeper into telecommunications networks. Based on available evidence, researchers do not observe the initial stages of the intrusion; consequently, the exact initial access vector remains unknown.

However, the post-deployment behavior of Showboat is well-established. Upon installation, the malware contacts its embedded C2 infrastructure, fetches an encrypted configuration file, and gathers host and environmental telemetry. It exhibits a comprehensive suite of operator-controlled capabilities, including remote access, file transfers, persistence mechanisms, process hiding, SOCKS5 proxying, and port mapping. Technically, the malware appears engineered less for immediate destruction and more for establishing a highly persistent foothold within heavily Linux-reliant environments to facilitate subsequent intrusion activities.

Reconnaissance

Immediately after retrieving its configuration file, Showboat gathers baseline host reconnaissance data from the compromised system, including:

• Hostname
• OS details
• List of running processes
• Process details of the agent itself
• Desktop screenshots.

This profiling enables operators to quickly ascertain the role of the compromised machine, observe user activity, and identify potential defensive tooling. The malware also supports scanning for other accessible devices, connecting via its SOCKS5 capability to identify adjacent systems situated deep within the internal network. This indicates that the implant is utilized not only to inventory the local host but also to map out reachable internal network segments.

Beyond the victim network, the campaign's infrastructure mirrors meticulous target profiling. The use of telecom-themed domains such as singtelcom[.]site and kaztelecom[.]shop underscores a deliberate focus on telecommunications organizations, particularly those operating across Asia.

Resource Development

The core C2 infrastructure identified includes:

• telecom.webredirect[.]org
• 139.84.227[.]139
• 194.135.25[.]132

By clustering self-signed X.509 certificates that shared identical metadata—specifically a unique "My Organization" subject/issuer pattern—Lumen has identified additional related nodes. This reveals a highly repeatable staging methodology used by the attackers, likely driven by shared setup scripts or deployment templates. The actors also maintain spoofed telecom domains (singtelcom[.]site, kaztelecom[.]shop) to deceive victims or to disguise their infrastructures.

An additional staging resource involves leveraging public "Dead-Drop" content hosted on services like Pastebin and online forums. Showboat's cloaking functions fetch code directly from these external repositories, meaning the attackers abuse legitimate public platforms as auxiliary infrastructure.

Finally, a node located at 116.169.244[.]208:2096, geographically positioned near Chengdu and associated with China Unicom, stands out from the infrastructure hosted on standard VPS providers. Researchers assess that this node likely represents upstream infrastructure or a developer testing environment.

Initial Access

Researchers explicitly state that because they have not observed the malware being actively deployed on a live system, the initial access method—whether achieved via vulnerability exploitation, compromised credentials, exposed services, phishing, or other vectors—remains undetermined.

Execution

Once inside a Linux host, Showboat executes as a modular agent compiled specifically for AMD x86-64 architectures. It initiates a connection to its hardcoded C2 server to fetch a configuration file, which is obfuscated using XOR encryption with the hardcoded key string look me, AV!. Reverse engineering of the binary has uncovered the following built-in functions:

• Spawn a remote shell
• Upload and download files
• Enable SOCKS5 proxying
• Enable port mapping
• Establish persistence
• Hide processes (via executing fetched code from Dead-Drop sites like Pastebin)
• Switch C2 nodes.

Of particular note is the execution path of the hide command. Instead of relying solely on code embedded natively within the binary, this function can pull code from external Dead-Drop sites like Pastebin or forums to mask the malware's processes from the host operating system.

Persistence

Showboat includes a default persistence function designed to act as a “act as a system service (Linux service/daemon)” utility. While the exact Linux persistence mechanisms utilized have not been uniquely identified, its presence confirms that persistence is an intentional, architected feature of the framework rather than a spontaneous action. This persistent operation is practically supported by the malware’s process-hiding capabilities; the hide command utilizes externally fetched code, rendering the function highly modular and resilient against static analysis.

Privilege Escalation

No explicit privilege escalation exploits or techniques have been documented in relation to this framework so far. However, depending on the targeted Linux environment, elevated privileges would be required to execute certain embedded functions, particularly those related to system-wide persistence and process hiding.

Defense Evasion

Showboat implements defense evasion in multiple layers:

• The configuration file is obfuscated via XOR using the hardcoded string look me, AV!. This represents a simple yet deliberate layer of concealment intended to hinder direct signature detection and automated analysis.
• Host data sent back to the C2 is encrypted and Base64-encoded prior to transmission. The malware constructs a JSON registration string containing host details, malware version, and a UUID, and subsequently "encrypts" this JSON using the last five characters of the UUID as the key.
• The hide command completely removes the malware's processes from standard system process listings, representing one of the framework's primary anti-detection features. Utilizing Dead-Drop sites like Pastebin or online forums to fetch codes adds indirectness and reduces the necessity of embedding all evasion logic directly inside the main binary.
• Infrastructure analysis reveals the use of unconventional yet plausible communication channels. One C2 node exposes a self-signed certificate over port 53. This leads researchers to infer that the attackers may abuse DNS-associated port 53 for standard malware communications to bypass firewall restrictions and evade network monitoring tools.
• The use of telecom-themed lookalike domains ensures the infrastructure appears legitimate within telecommunications network environments.

Discovery

Upon execution, Showboat conducts systematic host and network discovery, including:

• Hostname
• OS information
• Running processes
• Process details of the malware itself
• Desktop screenshots.

This telemetry provides operators with immediate situational awareness regarding the nature of the compromised asset and ongoing user activity. Furthermore, its ability to scan for other network devices integrates tightly with its SOCKS5 and portmap functions, allowing actors to outline reachable internal network architecture.

Lateral Movement

The framework's SOCKS5 proxying and port mapping capabilities appear to share the same underlying internal routines, distinguished primarily by URL flags appended during communication with the C2:

• "SKS" likely maps to SOCKS5 proxy functionality
• "MAP" likely maps to port mapping functionality.

These features enable a compromised Linux host to serve as a strategic foothold and relay. Operators can scan internal assets and subsequently establish connections to systems that are completely insulated from the public Internet and only reachable via the local area network (LAN).

This represents one of the most critical technical insights of the campaign: Showboat is not merely a remote access implant confined to a single host; it functions as a pivoting platform designed to bridge an external operator into internal network segments. This hands-on control and environment-wide mobility are further supported by its remote shell functionality.

Data Collection

Showboat collects system data alongside visual snapshots of user activities from the infected host, capturing the hostname, OS info, running processes, and its own process details. It also captures desktop screenshots which allow operators to determine if the host is actively used, inspect open applications, and verify whether the system belongs to an administrator or another high-value target.

Command and Control (C2)

The malware’s initial network action is an outbound call to its hardcoded C2 to retrieve its configuration file. A decrypted example of this configuration contains:

• SERVER_ADDRESS = telecom.webredirect[.]org
• SERVER_PORT = 80
• MIN_SLEEP = 5 / MAX_SLEEP = 10 (Standard Mode)
• SLOW_MODE_MIN_SLEEP = 20 / SLOW_MODE_MAX_SLEEP = 25 (Slow Mode).

After gathering host data, the malware synthesizes this information with values provided by the C2, such as the agent UUID, agent version, and sleep intervals. It then exfiltrates the host details back to the C2 as an encrypted, Base64-encoded string embedded within a PNG field.

Showboat also generates a JSON object outlining the compromised host, malware version, and UUID, encrypting it using the final five characters of the UUID as the key. This sequence forms a core component of the malware's registration and communication workflow.

The observed C2 infrastructure includes:

• telecom.webredirect[.]org (resolving to 139.84.227[.]139)
• A secondary C2 located at 194.135.25[.]132
• Port 9999 exposing a SOCKS5 banner
• Potential alternative communications handled via port 53.

Operators also retain the capability to switch C2 nodes dynamically, providing the framework with operational resilience and recovery options if a specific server is blocked or taken down.

‍

Exfiltration

While large-scale data theft has not been observed at this time, Showboat is clearly equipped with capabilities to stage and exfiltrate sensitive information. The malware transmits gathered host data—including system details and desktop screenshots—back to the C2 architecture in an encoded and encrypted format. Furthermore, its built-in file upload and download functionalities provide operators with the capability to move files to and from the compromised machine as required.

‍

Mitigation

Because the analysis does not identify the initial access vector or specific vulnerabilities exploited, mitigation efforts against Showboat should focus on detection, containment, system hardening, and enhancing visibility—particularly across Linux systems, routers, and edge-facing telecommunications infrastructure.

Enhancing Monitoring of Linux and Router Environments

As demonstrated by this campaign, threat actors actively leverage Linux-based systems and routers as strategic footholds because security monitoring for these assets is typically weaker than for traditional Windows endpoints. Organizations should extend security visibility into Linux servers and network devices by deploying logging, EDR, NDR, or equivalent telemetry tools. Defenders should audit process execution, persistence mechanisms, and the creation of suspicious services, while monitoring for unusual file transfers, remote shell activity, and process cloaking attempts.

The services most impacted by this recommendation include Internet-facing Linux servers, internal Linux application hosts, routers, and other perimeter devices that may currently fall outside the scope of standard endpoint security controls.

Monitoring and Blocking Known Indicators of Compromise (IOCs)

Security teams should ingest published indicators—including C2 domains and IPs, suspicious certificates and certificate metadata, telecom-themed spoofed domains, and anomalous ports or proxy infrastructure—into firewalls, DNS filtering, proxy controls, IDS/IPS, SIEM platforms, and threat hunting workflows.

This may impact DNS policies, outbound web filtering, network firewall rules, and TLS inspection workflows, particularly where telecom or infrastructure teams allow broad outbound connectivity for server networks.

Auditing East-West Traffic and Internal Proxy Behavior

Showboat is engineered as a post-exploitation foothold equipped with SOCKS5 proxying and port mapping capabilities to help attackers pivot deeper into internal networks and access systems insulated from the public Internet. To mitigate this risk, organizations should:

• Monitor East-West traffic between internal servers
• Establish normal server-to-server communication baseline
• Investigate traffic patterns that align poorly with standard business processes
• Detect unauthorized proxies, tunneling attempts, and internal relay behavior
• Audit traffic on unusual ports like 9999, as well as suspicious use of port 53 for non-DNS communications.

These mitigations will impact internal network segmentation policies, network monitoring platforms, firewall Access Control Lists (ACLs), and the interconnection of telecom backend services.

Hardening Edge Systems and Restricting Unnecessary Outbound Communications

Since the malware initially beacons to its built-in C2 infrastructure to download configuration data, organizations should restrict the ability of edge hosts to communicate freely with unknown external destinations. Recommended actions include:

• Restrict outbound server traffic to approved destinations only.
• Enforce least-privilege network egress rules.
• Restrict access to public paste sites, forums, and other Dead-Drop platforms.
• Review whether servers strictly require direct Internet connectivity.
• Segment sensitive telecommunications systems from general-purpose IT networks.

This impacts server egress policies, proxy allowlists, network access controls, and the segmentation between corporate IT and telecom operational environments.

Hunting for Suspicious Behavior over Malware Signatures

Given that the malware sample initially exhibited a zero-detection rate, relying solely on signature-based defenses is insufficient. Organizations should proactively hunt for behavioral patterns, such as:

• Unexpected outbound beaconing from Linux hosts.
• The retrieval of encrypted configuration data.
• Server systems contacting Dead-Drop resources on Pastebin or similar forums.
• Process cloaking or hiding behaviors.
• Unexplained screenshot capture or host reconnaissance activities.
• File upload or download activities originating from non-administrative systems.

This approach primarily impacts Security Operations Center (SOC) workflows, threat hunting initiatives, SIEM use cases, and the fine-tuning of behavioral analytics.

Reviewing Certificate- and Infrastructure-Based Detection

This campaign utilizes self-signed X.509 certificates with repetitive metadata patterns (e.g., "My Organization"). Defenders should inspect outbound TLS connections and exposed services to identify:

• Repetitive self-signed certificate patterns
• Suspicious reuse of certificates across unrelated hosts
• Certificates observed on unexpected ports
• Infrastructure engineered to mimic telecommunications entities.

This may require updates to TLS monitoring, certificate inventory practices, network sensor rules, and external attack surface management.

In short, the critical line of defense in this campaign is not a single software patch, but rather closing the visibility and monitoring gaps that allow a Linux-based implant to maintain long-term persistence, proxy traffic, and facilitate deeper network access.

‍

IoCs (Indicator of Compromise)

Network IoC Analysis‍

‍

• telecom.webredirect[.]org / 139.84.227[.]139: Resolved to a Vultr instance in South Africa. It is flagged as malicious by multiple vendors on VirusTotal (VT). Shodan analysis reveals non-standard services running on ports such as 6666, 8080, and 8443, which highly correlates with known Showboat C2 and proxying behavior.
• 194.135.25[.]132: Positioned within a Kazakhtelecom ASN, aligning with the secondary C2 node noted in the threat intelligence report.
• singtelcom[.]site, kaztelecom[.]shop: Currently do not resolve, but remain flagged as malicious by multiple vendors on VT. These are telecommunications-themed lookalike domains.
• 116.169.244[.]208: Located within a Chengdu Unicom network segment; assessed as potential upstream infrastructure or a developer testing environment.
• Other JP/US Cloud Hosts: Associated with weaker technical correlation; recommended to be placed on an observation list.

Recommendation: Immediately block all core Indicators of Compromise (IoCs). Concurrently conduct retrospective hunting across Linux hosts for outbound connections, SOCKS5, port mapping activities, and anomalous proxying behavior.

‍Domains

IPv4s

Certificate Fingerprints

‍

Reference

• Introducing Showboat: A new malware family taunts defenses and targets international telecom firms
• ‍Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor