# Showboat: Sophisticated Linux Post-Exploitation Framework Targeting Middle East Telecommunications

> Showboat is a sophisticated Linux ELF 64-bit post-exploitation framework attributed to Calypso (Bronze Medley / Red Lamassu), a PRC-backed APT group. Exclusively targeting AMD x86-64 systems in Middle East telecommunications since mid-2022, Showboat maintained zero detections across 65 VirusTotal engines until April 2026. The malware uses advanced evasion including XOR encryption, LD_PRELOAD rootkit-based process injection, and PNG-field beacon obfuscation. Evidence links Showboat to state-sponsored espionage objectives with long-term strategic network access goals.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-06-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0990
- **ID:** TL-2026-0990
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Calypso (China)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Showboat is a purpose-built Linux remote access trojan (RAT) with rootkit capabilities developed and deployed by the Calypso threat group (also tracked as Bronze Medley, Red Lamassu). The malware exclusively targets AMD x86-64 Linux systems used in Middle East telecommunications infrastructure, with confirmed victims in Afghanistan, Azerbaijan, and possible compromises in the United States and Ukraine. The campaign began in mid-2022 and remained undetected for approximately four years, representing a critical intelligence collection operation against critical telecommunications infrastructure. The malware implements sophisticated evasion techniques including dynamic linker hijacking via LD_PRELOAD modification of /etc/ld.so.preload, XOR-encrypted command-and-control beacon obfuscation using the hardcoded key 'look me, AV!', Base64 encoding, and steganographic embedding of exfiltrated data within PNG ancillary fields. Showboat's architectural design emphasizes stealth and operational persistence: it achieves system-level process hiding by hooking core syscalls (readdir, etc.) through injected shared objects, filters beacon execution against hardcoded process name patterns (kworkers, dbus, autoupdate) to blend with legitimate system activity, and supports randomized HTTP beaconing intervals (5-10 seconds standard, 20-25 seconds stealth mode) to evade timing-based detection. The malware retrieves process-hiding source code from Pastebin (C file ukpkmkk.c, originally posted 2022-01-11) and compiles it on-host via gcc into injection-ready shared objects, eliminating pre-compiled binary signatures. Command-and-control occurs over HTTP port 80 to the domain telecom.webredirect[.]org (hosting infrastructure in Chengdu, China), with integrated SOCKS5 proxy functionality enabling lateral movement to non-internet-facing infrastructure within target networks. The threat actor uses a modular command structure supporting file transfers, directory manipulation, remote shell execution, screenshot capture, and multi-stage payload injection. The malware collects system reconnaissance including hostname, OS details, UUID, and running process enumeration, all transmitted through encrypted HTTP POST requests with application-layer XOR encryption. Showboat represents the operational maturity of Calypso (active since 2016, documented by Positive Technologies in October 2019) and its access to custom malware development capabilities. The absence of financial/ransom motives across four years of operation, combined with exclusive targeting of critical telecommunications infrastructure in geopolitically sensitive regions (Afghanistan, Azerbaijan, Middle East), indicates state-sponsored intelligence collection objectives and represents a sustained high-confidence threat to telecommunications networks globally.

## MITRE ATT&CK

- T1566 Phishing
- T1199 Trusted Relationship
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1564 Hide Artifacts
- T1140 Deobfuscate/Decode Files or Information
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1572 Protocol Tunneling
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1113 Screen Capture
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1074 Data Staged

## Sources

- [Showboat Malware: Targeting Middle East Telecom Firms Since 2022](https://www.picussecurity.com/resource/blog/showboat-malware-targeting-middle-east-telecom-firms-since-2022)
- [Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor](https://thehackernews.com/2026/05/showboat-linux-malware-hits-middle-east.html)
- [China-Linked Showboat Malware Uses Linux Persistence to Target Telecom Companies](https://cybersecuritynews.com/china-linked-showboat-malware-uses-linux-persistence/)
- [Showboat Malware Uses Pastebin-Hosted C Code to Enable Linux Process Hiding](https://gbhackers.com/showboat-malware-uses-pastebin-hosted-c-code/)
- [Black Lotus Labs Initial Discovery and Analysis](https://blacklotuslabs.com/research/showboat/)
- [Calypso APT Group: Historical Analysis by Positive Technologies](https://www.ptsecurity.com/research/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0990