TF-MAL-elf.showboat
📛 Threat Title
Malware family: Showboat
Description
ThreatFox malware family `elf.showboat`. Printable name: Showboat.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:cybernews.com
A newly discovered malware family dubbed " Showboat " is targeting telecom firms worldwide in a stealth campaign tied to China-linked cyber espionage, new research finds.
-
web:cyberpress.org
Black Lotus Labs has uncovered a highly elusive Linux-based post-exploitation framework dubbed Showboat . Active since mid-2022, this undocumented malware specifically targets telecommunications firms in the Middle East. Security researchers have attributed the framework to threat actors backed by the People's Republic of China (PRC) with moderate-to-high confidence. The attribution stems ...
-
web:cybersecuritynews.com
A sophisticated China-linked malware framework has been quietly targeting telecom companies across the Middle East for nearly four years. Showboat is a Linux-based tool that stayed completely hidden from antivirus systems until April 2026, raising serious concerns about the security of critical communications infrastructure worldwide.
-
web:socprime.com
Summary Showboat is a modular Linux post-exploitation framework built for AMD x86-64 environments. Active since mid-2022, it is designed to maintain quiet, long-term access inside compromised networks. The malware uses advanced evasion methods, including XOR encryption and abuse of the dynamic linker to conceal malicious processes.
-
web:thehackernews.com
Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a telecommunications provider in the Middle East since at least mid-2022. " Showboat is a modular post-exploitation framework designed for Linux systems, capable of spawning a remote shell, transferring files, and functioning as a SOCKS5 proxy," Lumen ...
-
web:www.anavem.com
Chinese hackers target Middle Eastern telecommunications providers using new Showboat Linux malware and JFMBackdoor Windows variants in sophisticated espionage campaign.
-
web:www.lumen.com
Black Lotus Labs reveals new malware discovery Showboat , a Linux-based post-exploitation framework linked to PRC-aligned threat activity targeting telecom providers.
-
web:www.picussecurity.com
Showboat is a stealthy Linux post-exploit framework targeting Middle East telecoms since 2022. Learn how it works and how to defend against it.
-
web:www.secpod.com
A previously undocumented Linux malware family named Showboat has been actively targeting telecommunications providers since at least mid-2022. The malware is believed to have been used by China-linked threat actors and has been observed operating against telecom entities in the Middle East and other regions.
-
web:xfe-integration.xforce.ibm.com
Black Lotus Labs, the threat research arm of Lumen, has identified a new Linux malware family named Showboat , which has been active since mid-2022. This modular post-exploitation framework is designed for Linux systems and is capable of spawning remote shells, transferring files, and functioning as a Socks5 proxy.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.