China-Linked Showboat Malware Targets Telecoms with Linux Persistence

Key Takeaways

• A sophisticated, Linux-based malware dubbed “Showboat” has been targeting Middle Eastern telecommunications firms since mid-2022.
• The malware, attributed with moderate-to-high confidence to China-backed threat groups, is designed for long-term espionage and covert system control.
• Showboat employs advanced evasion techniques, including randomized beaconing, data exfiltration via PNG images, and a Linux rootkit to remain undetected by security tools.
• The persistent threat operated for nearly four years without detection, raising significant concerns about the security posture of critical communications infrastructure.

China-Linked Showboat Malware Targets Telecoms with Linux Persistence

A highly advanced, China-linked malware framework known as Showboat has been silently compromising telecommunications companies across the Middle East for almost four years. This covert operation represents a sustained espionage campaign aimed squarely at critical infrastructure within the region.

Showboat is a Linux-based tool that maintained complete stealth from antivirus systems until April 2026, according to researchers. Its prolonged invisibility highlights significant vulnerabilities in the security defenses protecting global critical communications networks.

Unlike typical malicious software that encrypts files or demands ransom, Showboat’s purpose is to grant attackers persistent, silent control over infected systems and their connected networks. This facilitates long-term intelligence gathering rather than immediate disruption or financial gain.

The malware operates on AMD x86-64 Linux machines, making it particularly dangerous for the high-value servers that form the backbone of telecom operations.

Security researchers at Picus meticulously documented this threat in a report shared with Cyber Security News (CSN). Their findings confirm that Showboat has been active since mid-2022 and managed to evade all 65 antivirus engines on VirusTotal when tested in May 2025. This exceptional level of stealth allowed the threat actors to operate unimpeded within telecom networks for approximately four years without triggering any alarms.

Analysts attribute the malware with moderate-to-high confidence to state-backed threat groups operating out of China. This assessment is based on command-and-control (C2) infrastructure traced back to Chengdu, China, and the observed tactics, techniques, and procedures (TTPs) that closely align with other known Chinese advanced persistent threat (APT) operations active in the region.

The exclusive deployment against Middle Eastern telecommunications companies underscores a deliberate and strategic, long-running espionage campaign. Telecom providers manage vast quantities of sensitive communication data, making them prime targets for nation-state actors seeking sustained intelligence access. This narrow geographic and industry focus leaves little doubt regarding the strategic intent behind these attacks.

Operational Mechanics of Showboat

Upon execution on a compromised machine, Showboat initiates communication with its embedded command-and-control server to retrieve an encrypted configuration file. This file is obfuscated using a simple XOR cipher, utilizing the hardcoded key “look me, AV!”, a phrase that appears to mock security tools.

Once decrypted, the configuration reveals crucial operational parameters, including the C2 server address, port settings, and randomized sleep intervals designed to prevent detection through predictable beaconing patterns. Instead of fixed communication intervals, Showboat randomizes its check-in times, making it harder to flag as malicious traffic.

The malware gathers extensive host details, including the system name, operating system specifics, a list of running processes, and even captures a screenshot of the system. All collected data is encrypted, base64-encoded, and then cleverly embedded within a PNG image file before exfiltration. This technique makes the outbound traffic appear innocuous, further aiding evasion.

A particularly challenging aspect of Showboat’s detection evasion is its “hide” command. When activated, the malware fetches a small C source file from a Pastebin page controlled by the attackers. It then compiles this file directly on the victim’s machine and leverages a Linux feature called ld.so.preload to hook system calls. This rootkit functionality renders Showboat’s own processes completely invisible to standard administrative tools like ps and top, which are commonly used to monitor server activity.

Evasion Techniques and Stealth Design

Showboat’s architecture showcases a sophisticated design where every primary feature is geared towards maintaining stealth. Its use of XOR encryption, randomized C2 beaconing, and the smuggling of data within PNG images collectively aim to deceive both automated security tools and human analysts scrutinizing network logs. An additional layer of concealment is provided by a hardcoded process filter list, which hides entries named “kworkers,” “dbus,” and “autoupdate”—names designed to mimic legitimate system processes.

The framework provides standard remote access capabilities, including file transfers, directory manipulation, and the establishment of long-term persistence. The combination of these stacked stealth techniques truly distinguishes Showboat from much of the malware observed in the wild. Its ability to remain undetected for approximately four years serves as compelling evidence that layered evasion methods can effectively bypass traditional defenses over extended periods.

What You Should Do

• Organizations, particularly those in the telecommunications sector, are strongly advised to simulate Showboat attack scenarios to assess the efficacy of their existing security controls.
• Conduct thorough testing against realistic malware behaviors, encompassing both network infiltration and data exfiltration paths, to identify and remediate any critical detection gaps.
• Implement robust network segmentation and monitoring to detect unusual traffic patterns, especially those involving outbound PNG files with hidden data.
• Regularly audit Linux server configurations, paying close attention to ld.so.preload files and other persistence mechanisms that can be abused by sophisticated malware.
• Enhance threat intelligence sharing and awareness regarding nation-state APT activities, particularly those linked to China and targeting critical infrastructure.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.