Showboat: Sophisticated Linux Post-Exploitation Framework Targeting Middle East Telecommunications
Showboat: Sophisticated Linux Post-Exploitation Framework (TL-2026-0990) is a critical-severity malware campaign, first published 2026-06-28. It is attributed to Calypso (China) with medium confidence, affects Linux AMD x86-64 Linux Systems, maps to 21 MITRE ATT&CK techniques (T1027, T1041, T1055), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0990
- Threat ID
- TL-2026-0990
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-28
- Last reviewed
- 2026-06-28
- Attribution
- Calypso
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- telecoms, critical-infrastructure, government-communications
- Target regions
- Middle East, North Africa, 143 - Central Asia, South Asia
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Showboat: Sophisticated Linux Post-Exploitation Framework
Malware and tooling: Showboat, ukpkmkk.c, ukpkmkk.so
Showboat is a sophisticated Linux ELF 64-bit post-exploitation framework attributed to Calypso (Bronze Medley / Red Lamassu), a PRC-backed APT group. Exclusively targeting AMD x86-64 systems in Middle East telecommunications since mid-2022, Showboat maintained zero detections across 65 VirusTotal engines until April 2026. The malware uses advanced evasion including XOR encryption, LD_PRELOAD rootkit-based process injection, and PNG-field beacon obfuscation. Evidence links Showboat to state-sponsored espionage objectives with long-term strategic network access goals.
How Showboat: Sophisticated Linux Post-Exploitation Framework works
Showboat is a purpose-built Linux remote access trojan (RAT) with rootkit capabilities developed and deployed by the Calypso threat group (also tracked as Bronze Medley, Red Lamassu). The malware exclusively targets AMD x86-64 Linux systems used in Middle East telecommunications infrastructure, with confirmed victims in Afghanistan, Azerbaijan, and possible compromises in the United States and Ukraine. The campaign began in mid-2022 and remained undetected for approximately four years, representing a critical intelligence collection operation against critical telecommunications infrastructure. The malware implements sophisticated evasion techniques including dynamic linker hijacking via LD_PRELOAD modification of /etc/ld.so.preload, XOR-encrypted command-and-control beacon obfuscation using the hardcoded key 'look me, AV!', Base64 encoding, and steganographic embedding of exfiltrated data within PNG ancillary fields. Showboat's architectural design emphasizes stealth and operational persistence: it achieves system-level process hiding by hooking core syscalls (readdir, etc.) through injected shared objects, filters beacon execution against hardcoded process name patterns (kworkers, dbus, autoupdate) to blend with legitimate system activity, and supports randomized HTTP beaconing intervals (5-10 seconds standard, 20-25 seconds stealth mode) to evade timing-based detection. The malware retrieves process-hiding source code from Pastebin (C file ukpkmkk.c, originally posted 2022-01-11) and compiles it on-host via gcc into injection-ready shared objects, eliminating pre-compiled binary signatures. Command-and-control occurs over HTTP port 80 to the domain telecom.webredirect[.]org (hosting infrastructure in Chengdu, China), with integrated SOCKS5 proxy functionality enabling lateral movement to non-internet-facing infrastructure within target networks. The threat actor uses a modular command structure supporting file transfers, directory manipulation, remote shell execution, screenshot capture, and multi-stage payload injection. The malware collects system reconnaissance including hostname, OS details, UUID, and running process enumeration, all transmitted through encrypted HTTP POST requests with application-layer XOR encryption. Showboat represents the operational maturity of Calypso (active since 2016, documented by Positive Technologies in October 2019) and its access to custom malware development capabilities. The absence of financial/ransom motives across four years of operation, combined with exclusive targeting of critical telecommunications infrastructure in geopolitically sensitive regions (Afghanistan, Azerbaijan, Middle East), indicates state-sponsored intelligence collection objectives and represents a sustained high-confidence threat to telecommunications networks globally.
MITRE ATT&CK techniques used in TL-2026-0990
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1571 Non-Standard Port; T1573 Encrypted Channel
Collection
collection
Initial Access
T1199 Trusted Relationship; T1566 Phishing
Persistence
T1547 Boot or Logon Autostart Execution
Credential Access
command-and-control
stealth
Affected products and versions in Showboat: Sophisticated Linux Post-Exploitation Framework
- Linux — AMD x86-64 Linux Systems
Vulnerable versions: All versions (architecture-specific: AMD x86-64 only)
Fixed in: None (malware, not vulnerability) - Telecommunications Industry — Telecom Infrastructure (MENA Region)
Vulnerable versions: All versions
Remediation for Showboat: Sophisticated Linux Post-Exploitation Framework
Patches
- No vendor patches available (not a CVE-based vulnerability)
- Upgrade to latest Linux kernel versions with grsecurity/PaX if available
- Apply all available security updates to compiler toolchain (gcc, binutils)
Immediate actions
- Block C2 domain telecom.webredirect[.]org at perimeter firewalls and DNS level
- Scan all AMD x86-64 Linux systems for modifications to /etc/ld.so.preload file
- Monitor for and terminate suspicious gcc/compiler processes executing from /tmp or unusual directories
- Review system logs for LD_PRELOAD environment variable references and dynamic library injection
- Implement network-wide block on outbound access to paste.pastebin.com (Pastebin raw page retrieval)
- Conduct emergency threat hunt for hidden processes using specialized rootkit detection tools
- Review and audit HTTP beacon communications to telecom.webredirect[.]org for exfiltrated data
Workarounds
- Restrict root privilege execution and implement principle of least privilege
- Disable dynamic library preloading where not required (LD_PRELOAD restrictions via AppArmor/SELinux)
- Implement file-level access controls preventing /etc/ld.so.preload modification
- Monitor and restrict compiler/gcc access to system directories
- Implement egress filtering preventing access to Pastebin and similar code-hosting platforms
Longer-term hardening
- Deploy endpoint detection and response (EDR) with kernel-level rootkit detection capabilities
- Implement mandatory SELinux or AppArmor security modules to restrict library injection attacks
- Enable integrity checking on critical system files (/etc/ld.so.preload, /lib, /lib64, /usr/lib directories)
- Establish continuous monitoring for gcc execution and .so file compilation in system directories
- Implement defense-in-depth network segmentation to restrict lateral movement via SOCKS5 proxies
- Develop and deploy detection signatures for PNG-wrapped HTTP exfiltration patterns
- Conduct behavioral analysis training for security teams on LD_PRELOAD rootkit detection techniques
Timeline of Showboat: Sophisticated Linux Post-Exploitation Framework
- Calypso threat group (Bronze Medley, Red Lamassu) becomes operationally active; initial infrastructure development phase begins
- Positive Technologies first publicly documents Calypso threat group, establishing attribution baseline and operational profile
- Pastebin paste (ukpkmkk.c - LD_PRELOAD injection source code) created; infrastructure preparation phase for Showboat deployment
- Showboat deployment campaign against Middle East telecommunications infrastructure begins; targets include Afghanistan ISP and Azerbaijan entities
- Showboat operations consolidate; maintained zero detections across all 65 VirusTotal engines; operational maturity achieved
- ELF 64-bit Showboat binary (SHA256: d6a4fad5448838dbc8cc6b33f1dbfbdc7a2fad36de58ff6a66dce96f729f7011) uploaded to VirusTotal; achieves 0/65 AV detections - peak evasion success
- Black Lotus Labs identifies and publicly discloses Showboat malware; AV vendors begin developing signatures; four-year undetected operational period ends
- The Hacker News publishes comprehensive Showboat threat analysis; media coverage expands threat awareness
- GBHackers publishes detailed technical analysis of Pastebin-hosted C code and LD_PRELOAD injection mechanisms
- PICUS Security, Cybersecurity News, and additional threat intelligence firms publish comprehensive Showboat analysis; coordinated threat intelligence release
- Complete threat intelligence package published to Threadlinqs Intelligence platform; industry-wide defensive measures encouraged
Sources cited for Showboat: Sophisticated Linux Post-Exploitation Framework
- Showboat Malware: Targeting Middle East Telecom Firms Since 2022
- Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor
- China-Linked Showboat Malware Uses Linux Persistence to Target Telecom Companies
- Showboat Malware Uses Pastebin-Hosted C Code to Enable Linux Process Hiding
- Black Lotus Labs Initial Discovery and Analysis
- Calypso APT Group: Historical Analysis by Positive Technologies
Threats related to Showboat: Sophisticated Linux Post-Exploitation Framework
Detection coverage for TL-2026-0990
As of 2026-06-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0990 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.