Showboat Malware: Targeting Middle East Telecom Firms Since 2022

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Showboat Malware: Targeting Middle East Telecom Firms Since 2022

Key Takeaways

  • Showboat is a modular, Linux-based post-exploitation framework targeting AMD x86-64 systems, active since mid-2022.
  • The malware achieved zero antivirus detection across 65 engines and remained undetected until April 2026.
  • Showboat has been used exclusively against telecommunications companies in the Middle East, attributed with moderate-to-high confidence to PRC-backed threat actors.
  • The framework uses XOR encryption with a hardcoded key and disguises beacon data inside PNG fields to evade detection.
  • Showboat supports standard RAT capabilities, including file transfers, directory manipulation, and long-term persistence mechanisms.
  • Picus Threat Library includes dedicated simulation threats for Showboat across Network Infiltration and Email Infiltration attack modules.

Black Lotus Labs recently revealed a new and undocumented Linux-based post-exploit framework known as Showboat [1].

Article Link: Showboat Malware: Targeting Middle East Telecom Firms Since 2022