Showboat Malware: Targeting Middle East Telecom Firms Since 2022

Key Takeaways

• Showboat is a modular, Linux-based post-exploitation framework targeting AMD x86-64 systems, active since mid-2022.
• The malware achieved zero antivirus detection across 65 engines and remained undetected until April 2026.
• Showboat has been used exclusively against telecommunications companies in the Middle East, attributed with moderate-to-high confidence to PRC-backed threat actors.
• The framework uses XOR encryption with a hardcoded key and disguises beacon data inside PNG fields to evade detection.
• Showboat supports standard RAT capabilities, including file transfers, directory manipulation, and long-term persistence mechanisms.
• Picus Threat Library includes dedicated simulation threats for Showboat across Network Infiltration and Email Infiltration attack modules.

Black Lotus Labs recently revealed a new and undocumented Linux-based post-exploit framework known as Showboat [1].

Showboat has existed since mid-2022, has evaded every form of antivirus detection, and has been used exclusively against telecommunications companies in the Middle East region. It is associated with high-confidence PRC-backed threat actors.

We'll be analyzing the technical details below, and we will explain how Picus validates your defenses against this threat.

What Is Showboat?

Showboat is a modular post-exploitation framework made for AMD x86-64 Linux. It isn't a dropper or ransomware; it's meant to provide operators with silent, long-lasting access to a compromised computer and the network around it.

This malware is an ELF 64-bit executable. When scanned in May 2025, VirusTotal showed a zero detection rate out of 65 available engines. So Showboat initially went undetected. Its shadowy presence continued that way until April 2026.

This tool is linked with moderate-to-high confidence to threat groups aligned with China. The basis for this attribution is the C2 infrastructure traced back to Chengdu, China. Also, the methods used line up with known tools and tactics from other Chinese APT groups.

How Does Showboat Malware Work?

Initial Encrypted Config

After execution, Showboat first grabs a config file from its built-in C2 server. The config file uses XOR encryption. Each byte is decrypted using a hardcoded XOR key: "look me, AV!".

Here’s a Python snippet showing that decryption process:

Once decrypted, the config file looks like this:

Note that rather than contacting the server at fixed intervals, which would make predictable patterns and be easier to spot, the malware chooses random wait times between minimums and maximums.

The Heartbeat Beacon

Post-config fetch, Showboat collects some key info from the host, like the hostname, OS details, and a list of running processes. It throws in its own process data and even takes a screenshot. Then it bundles all this info along with the C2-sent values (like UUID and version) into a JSON string, encrypts it with part of the UUID, encodes it in base64, and wraps it in a PNG field before sending it out.

So, the data gets packaged something like this:

Command Set of Showboat

Key commands available in Showboat let the operator control file transfers, alter directories, and set up persistence methods. These are standard RAT features.

But it also has some outstanding features. One of them is the hide command.

When invoked, it fetches a C source file (ukpkmkk.c) from a Pastebin page set up by the threat actors, compiles it on the victim machine, then uses ld.so.preload to inject it into the dynamic linker.

The ld.so.preload mechanism is a Linux feature that lets you specify shared libraries to load before anything else. Malware abuses this to hook system calls, in this case, functions like readdir() that tools like ps and top use to enumerate processes. If your process name is on the filter list, it simply never shows up.

The code snippet retrieved from Pastebin included a hardcoded process filter list:

Overall, it fits as a remote access toolset with advanced features for long-term, stealthy operations.

How Picus Simulates Showboat Attacks?

We also strongly suggest simulating Showboat Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other malware variants, such as BRICKSTORM, VenomRAT, Chinotto, and Rustonotto, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the Showboat Attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.