# Showboat (EvaRAT): PRC-Backed Modular Linux Post-Exploitation Framework Targeting Middle East Telecom Firms Since 2022

> Showboat is a modular ELF 64-bit Linux post-exploitation framework attributed with moderate-to-high confidence to PRC-backed actors (overlapping with Calypso/Bronze Medley/Red Lamassu; tracked by Kaspersky as EvaRAT) that has targeted Middle East telecommunications providers since mid-2022. It provides remote shell, file transfer, screenshot, and SOCKS5 proxy capabilities while evading defenders with XOR-encrypted configs, PNG steganography for beacon data, and ld.so.preload-based process hiding. The sample sat at 0/65 detections on VirusTotal from May 2025 until first detection in April 2026.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0839
- **ID:** TL-2026-0839
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Calypso (China)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Showboat is a sophisticated modular post-exploitation framework compiled as an AMD x86-64 ELF 64-bit executable, discovered and named by Lumen Technologies' Black Lotus Labs. Functioning as a full-featured Linux remote access tool rather than a dropper or ransomware, it has been used in a long-running espionage campaign against telecommunications providers in the Middle East since mid-2022, with secondary victims observed at an Afghanistan-based ISP, an Azerbaijan entity, and possible compromises in the United States and Ukraine.

The framework's operators chose a deliberately taunting design: configuration files are XOR-encrypted with the hardcoded key "look me, AV!", a direct provocation to antivirus engines. Beacon data containing collected host information is serialized as JSON, mixed with a UUID component, base64-encoded, and then wrapped inside a PNG field before exfiltration over HTTP, blending command-and-control traffic with seemingly benign image data. Beacon timing uses randomized sleep between a configurable minimum and maximum (e.g., 5-10 seconds in normal mode and 20-25 seconds in a "slow mode") to frustrate network-based detection.

For stealth on the host, Showboat implements a "hide" command that retrieves C source code from a Pastebin dead drop (a paste created 11 January 2022, referencing the file ukpkmkk.c), compiles it on the victim, and registers the resulting shared object via /etc/ld.so.preload. The injected library hooks libc functions such as readdir() to filter out the malware's own processes (filter list: kworkers|dbus|autoupdate) so they are invisible to tools like ps and top, giving the implant a userland-rootkit capability.

Core modules include an interactive remote shell, arbitrary file upload/download and directory manipulation, process enumeration, screenshot capture, and a SOCKS5 proxy used to tunnel traffic, scan internal networks, and enable lateral movement. A companion Windows implant tracked as JFMBackdoor — delivered via DLL side-loading and providing remote shell, file operations, network proxying, screenshots, and self-removal — was observed in the same operations.

Attribution points to PRC nexus actors with moderate-to-high confidence: command-and-control infrastructure is concentrated in Chengdu, Sichuan Province, China (including a node at 116.169.244.208:2096 on China Unicom), and the tradecraft overlaps with the Calypso group (also tracked as Bronze Medley and Red Lamassu), active since at least September 2016 and historically associated with tooling such as PlugX, WhiteBird, and BYEBY/Mikroceen, plus connections to the SixLittleMonkeys and Webworm clusters. Threat-actor-controlled impersonation domains (singtelcom[.]site, kaztelecom[.]shop) masquerade as regional telecom brands to support the campaign.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1574 Hijack Execution Flow
- T1014 Rootkit
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1001 Data Obfuscation
- T1573 Encrypted Channel
- T1090 Proxy
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1008 Fallback Channels
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel

## Sources

- [Introducing Showboat: A new malware family taunts defenses and targets international telecom firms](https://www.lumen.com/blog/en-us/introducing-showboat-a-new-malware-family-taunts-defenses-and-targets-international-telecom-firms)
- [Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor](https://thehackernews.com/2026/05/showboat-linux-malware-hits-middle-east.html)
- [New Linux malware 'Showboat' targets Middle East telecom provider](https://www.scworld.com/brief/new-linux-malware-showboat-targets-middle-east-telecom-provider)
- [Showboat: A novel Linux post-exploitation framework targeting telecommunications](https://www.technadu.com/showboat-a-novel-linux-post-exploitation-framework-targeting-telecommunications/628291/)
- [Showboat Malware Targeting Middle East Telecom Firms Since 2022](https://www.picussecurity.com/resource/blog/showboat-malware-targeting-middle-east-telecom-firms-since-2022)
- [Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor (GajShield KB)](https://kb.gajshield.com/a/913/showboat-linux-malware-hits-middle-east-telecom-with-socks5-proxy-backdoor)
- [Advanced Linux Malware Campaign Hits Telecom Sector in the Middle East (SecureReading)](https://securereading.com/showboat-linux-malware-middle-east-telecom-backdoor/)
- [Black Lotus Labs IOCs (GitHub)](https://github.com/blacklotuslabs/IOCs)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0839