Showboat Linux post-exploitation backdoor framework
Malware Activity
Summary
Hide ▲
Show ▼
The Showboat Linux malware has been identified as a modular post-exploitation framework used since at least mid-2022, raising the risk of persistent access on compromised systems. It can spawn a remote shell, transfer files, and operate as a SOCKS5 proxy, giving operators flexible control over infected hosts. Investigators linked the activity to China-affiliated clusters and observed related infrastructure and possible compromises across the Middle East, Afghanistan, Azerbaijan, the U.S., and Ukraine.
Related Happenings
Calypso telecommunications espionage campaign using Showboat and JFMBackdoor
Campaign
First: 21.05.2026 17:00
Last: 21.05.2026 17:00
Sources 1
About this happening:
A **Calypso / Red Lamassu** espionage campaign is targeting **telecommunications providers** with new **Showboat** and **JFMBackdoor** malware, increasing the risk of long-term co...
Calypso telecommunications espionage campaign using Showboat and JFMBackdoor
CampaignAbout this happening: A **Calypso / Red Lamassu** espionage campaign is targeting **telecommunications providers** with new **Showboat** and **JFMBackdoor** malware, increasing the risk of long-term co...
Showboat / kworker Linux post-exploitation malware activity
Malware Activity
First: 21.05.2026 17:00
Last: 21.05.2026 17:00
Sources 1
About this happening:
Researchers tied **Showboat** / **kworker** to a stealthy **Linux post-exploitation framework** being reused across multiple Chinese threat clusters, raising concern that a shared...
Showboat / kworker Linux post-exploitation malware activity
Malware ActivityAbout this happening: Researchers tied **Showboat** / **kworker** to a stealthy **Linux post-exploitation framework** being reused across multiple Chinese threat clusters, raising concern that a shared...
Chinese state-aligned Showboat espionage campaign targeting telecoms in Central Asia
Campaign
First: 21.05.2026 17:00
Last: 21.05.2026 17:00
Sources 1
About this happening:
A **multi-year Chinese state-aligned espionage campaign** is using **Showboat** to target **telecommunications companies in Central Asia and beyond**, increasing the risk of cover...
Chinese state-aligned Showboat espionage campaign targeting telecoms in Central Asia
CampaignAbout this happening: A **multi-year Chinese state-aligned espionage campaign** is using **Showboat** to target **telecommunications companies in Central Asia and beyond**, increasing the risk of cover...
Filemanager backdoor delivered on compromised cPanel environments
Malware Activity
First: 11.05.2026 20:54
Last: 11.05.2026 20:54
Sources 1
About this happening:
The **Filemanager** backdoor is being deployed on **compromised cPanel/WHM systems**, giving attackers **remote command execution** and shell access. It is delivered through a **s...
Filemanager backdoor delivered on compromised cPanel environments
Malware ActivityAbout this happening: The **Filemanager** backdoor is being deployed on **compromised cPanel/WHM systems**, giving attackers **remote command execution** and shell access. It is delivered through a **s...
QUIC RAT delivered through compromised DAEMON Tools installers
Malware Activity
First: 05.05.2026 19:07
Last: 05.05.2026 19:07
Sources 1
About this happening:
A follow-on **QUIC RAT** payload was delivered through compromised **DAEMON Tools installers**, extending the supply-chain intrusion into **remote access** on a small subset of in...
QUIC RAT delivered through compromised DAEMON Tools installers
Malware ActivityAbout this happening: A follow-on **QUIC RAT** payload was delivered through compromised **DAEMON Tools installers**, extending the supply-chain intrusion into **remote access** on a small subset of in...
Latest development: 07.05.2026 12:30
Disc Soft released malware-free Daemon Tools Lite Version 12.6 on May 5 after being notified of the supply chain attack on its build environment, and the affected 12.5.1 build was removed from distribution so users could move to the cleaned release.
Timeline
-
21.05.2026 17:17 1 articles · 6d ago
Showboat concealment snippet created
Technical Analysis UpdateA Pastebin code snippet later retrieved by Showboat to hide itself on infected Linux hosts was created on January 11, 2022, indicating a preexisting concealment component used to reduce process-list visibility and support persistent footholds on compromised systems.
Show sources
- Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor — thehackernews.com — 21.05.2026 17:17
-
21.05.2026 17:17 2 articles · 6d ago
Showboat Linux malware disclosed
Initial DisclosureCybersecurity researchers disclosed Showboat as a Linux malware used against a Middle East telecommunications provider since at least mid-2022 and described it as a modular post-exploitation framework that can spawn a remote shell, transfer files, act as a SOCKS5 proxy, contact C2 infrastructure, gather system information, and conceal itself with a Pastebin-hosted snippet; investigators also linked the activity to China-affiliated clusters and found further victims or possible compromises in Afghanistan, Azerbaijan, the U.S., and Ukraine.
Show sources
- Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor — thehackernews.com — 21.05.2026 17:17
- Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor — thehackernews.com — 21.05.2026 17:17