Showboat (EvaRAT): PRC-Backed Modular Linux Post-Exploitation Framework Targeting Middle East Telecom Firms Since 2022
Showboat (EvaRAT) (TL-2026-0839), also tracked as EvaRAT, is a high-severity malware campaign, first published 2026-06-17. It is attributed to Calypso (China) with medium confidence, affects Linux Linux (AMD x86-64 / ELF 64-bit servers), maps to 24 MITRE ATT&CK techniques (T1001, T1005, T1008), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0839
- Threat ID
- TL-2026-0839
- Also known as
- EvaRAT, Showboat
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-17
- Last reviewed
- 2026-06-17
- Attribution
- Calypso
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- telecommunications, internet service providers, critical infrastructure
- Target regions
- Middle East, Central Asia, Afghanistan, Azerbaijan, United States, Ukraine
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Showboat (EvaRAT)
Malware and tooling: JFMBackdoor, Showboat (SOCKS5 proxy backdoor, randomized 5-10s / slow-mode 20-25s beacon)
Showboat is a modular ELF 64-bit Linux post-exploitation framework attributed with moderate-to-high confidence to PRC-backed actors (overlapping with Calypso/Bronze Medley/Red Lamassu; tracked by Kaspersky as EvaRAT) that has targeted Middle East telecommunications providers since mid-2022. It provides remote shell, file transfer, screenshot, and SOCKS5 proxy capabilities while evading defenders with XOR-encrypted configs, PNG steganography for beacon data, and ld.so.preload-based process hiding. The sample sat at 0/65 detections on VirusTotal from May 2025 until first detection in April 2026.
How Showboat (EvaRAT) works
Showboat is a sophisticated modular post-exploitation framework compiled as an AMD x86-64 ELF 64-bit executable, discovered and named by Lumen Technologies' Black Lotus Labs. Functioning as a full-featured Linux remote access tool rather than a dropper or ransomware, it has been used in a long-running espionage campaign against telecommunications providers in the Middle East since mid-2022, with secondary victims observed at an Afghanistan-based ISP, an Azerbaijan entity, and possible compromises in the United States and Ukraine.
The framework's operators chose a deliberately taunting design: configuration files are XOR-encrypted with the hardcoded key "look me, AV!", a direct provocation to antivirus engines. Beacon data containing collected host information is serialized as JSON, mixed with a UUID component, base64-encoded, and then wrapped inside a PNG field before exfiltration over HTTP, blending command-and-control traffic with seemingly benign image data. Beacon timing uses randomized sleep between a configurable minimum and maximum (e.g., 5-10 seconds in normal mode and 20-25 seconds in a "slow mode") to frustrate network-based detection.
For stealth on the host, Showboat implements a "hide" command that retrieves C source code from a Pastebin dead drop (a paste created 11 January 2022, referencing the file ukpkmkk.c), compiles it on the victim, and registers the resulting shared object via /etc/ld.so.preload. The injected library hooks libc functions such as readdir() to filter out the malware's own processes (filter list: kworkers|dbus|autoupdate) so they are invisible to tools like ps and top, giving the implant a userland-rootkit capability.
Core modules include an interactive remote shell, arbitrary file upload/download and directory manipulation, process enumeration, screenshot capture, and a SOCKS5 proxy used to tunnel traffic, scan internal networks, and enable lateral movement. A companion Windows implant tracked as JFMBackdoor — delivered via DLL side-loading and providing remote shell, file operations, network proxying, screenshots, and self-removal — was observed in the same operations.
Attribution points to PRC nexus actors with moderate-to-high confidence: command-and-control infrastructure is concentrated in Chengdu, Sichuan Province, China (including a node at 116.169.244.208:2096 on China Unicom), and the tradecraft overlaps with the Calypso group (also tracked as Bronze Medley and Red Lamassu), active since at least September 2016 and historically associated with tooling such as PlugX, WhiteBird, and BYEBY/Mikroceen, plus connections to the SixLittleMonkeys and Webworm clusters. Threat-actor-controlled impersonation domains (singtelcom[.]site, kaztelecom[.]shop) masquerade as regional telecom brands to support the campaign.
MITRE ATT&CK techniques used in TL-2026-0839
Command and Control
T1001 Data Obfuscation; T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1571 Non-Standard Port; T1573 Encrypted Channel
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
stealth
T1027 Obfuscated Files or Information; T1574 Hijack Execution Flow
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059 Command and Scripting Interpreter
command-and-control
Resource Development
Affected products and versions in Showboat (EvaRAT)
- Linux — Linux (AMD x86-64 / ELF 64-bit servers)
Vulnerable versions: AMD64 Linux servers in telecom environments - Microsoft — Windows (via JFMBackdoor companion implant, DLL side-loading)
Vulnerable versions: Windows hosts targeted via DLL side-loading
Remediation for Showboat (EvaRAT)
Immediate actions
- Block C2 domain telecom.webredirect.org and impersonation domains singtelcom.site and kaztelecom.shop at DNS/perimeter
- Block known C2 IPs (139.84.227.139, 194.135.25.132, 116.169.244.208, 192.9.141.111, 64.176.43.209) and port 2096 traffic
- Inspect /etc/ld.so.preload on all Linux telecom hosts for unexpected shared-object entries and remove them
- Hunt for the SHA256 d6a4fad5448838dbc8cc6b33f1dbfbdc7a2fad36de58ff6a66dce96f729f7011 across the estate
Workarounds
- Make /etc/ld.so.preload immutable (chattr +i) where operationally feasible and alert on attempted modification
- Disable/monitor on-host compilers (gcc/cc) on production servers to break the runtime-compile hide step
Longer-term hardening
- Deploy Linux EDR with behavioral and file-integrity monitoring on telecom infrastructure
- Egress-filter and proxy HTTP so PNG-wrapped beaconing can be inspected; alert on PNG payloads with non-image entropy
- Restrict outbound access to paste/dead-drop services (e.g., Pastebin) from servers
- Baseline and monitor LD_PRELOAD / ld.so.preload changes via auditd
Timeline of Showboat (EvaRAT)
- Attributed actor cluster Calypso (aka Bronze Medley, Red Lamassu) active since at least September 2016, historically associated with PlugX, WhiteBird, and BYEBY/Mikroceen tooling.
- Pastebin dead-drop paste created, hosting C source code (file ukpkmkk.c) used by Showboat's 'hide' command for ld.so.preload-based process hiding.
- Showboat campaign begins targeting Middle East telecommunications providers (active since mid-2022).
- Self-signed X.509 certificate (SHA256 a72427af3c046fd90999a6505b2372dc4ffde122227f30ed21621ecd4f2d3e8b) observed on Showboat C2 infrastructure on port 53, supporting firewall/DNS-port evasion.
- Showboat sample submitted to VirusTotal showing a 0/65 detection rate across available engines.
- First potential United States compromise observed (one-day duration, 2025-11-27 to 2025-11-28) communicating with secondary-cluster C2 node 192.9.141.111.
- Afghanistan-based ISP victim observed communicating with C2 node 194.135.25.132 from 2025-12-01 through 2026-02-03.
- Second potential United States compromise observed (2025-12-29 to 2026-01-12) at secondary-cluster C2 node 192.9.141.111.
- Sample first detected/attributed by Lumen Black Lotus Labs after ~11 months of zero detections; Kaspersky separately tracks the artifact as EvaRAT.
- Lumen Black Lotus Labs publicly disclosed the Showboat framework with IOCs; widely reported (The Hacker News, SC Media, TechNadu).
- Picus Security published analysis of Showboat targeting Middle East telecom firms.
Sources cited for Showboat (EvaRAT)
- Introducing Showboat: A new malware family taunts defenses and targets international telecom firms
- Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor
- New Linux malware 'Showboat' targets Middle East telecom provider
- Showboat: A novel Linux post-exploitation framework targeting telecommunications
- Showboat Malware Targeting Middle East Telecom Firms Since 2022
- Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor (GajShield KB)
- Advanced Linux Malware Campaign Hits Telecom Sector in the Middle East (SecureReading)
- Black Lotus Labs IOCs (GitHub)
Threats related to Showboat (EvaRAT)
- Showboat: Sophisticated Linux Post-Exploitation Framework Targeting Middle East Telecommunications
- Calypso (Red Lamassu) China-Nexus Telco Espionage — Showboat Linux SOCKS5 Backdoor + JFMBackdoor Windows Implant
- TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses Telegram Bot API for C2 Against Middle East Governments
- Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
- Harvester APT Deploys New Linux Variant of GoGra (Backdoor.Gogra) Backdoor Abusing Microsoft Graph API and Outlook Mailboxes for Command-and-Control
- VoidLink Linux Rootkit Framework — eBPF + LKM Hybrid Persistence with ICMP C2
Detection coverage for TL-2026-0839
As of 2026-06-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0839 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.