Showboat Malware: Targeting Middle East Telecom Firms Since 2022

A Linux-based post-exploitation framework dubbed Showboat has been targeting telecommunications companies in the Middle East since mid-2022. Attributed with moderate-to-high confidence to PRC-backed threat actors, Showboat is a modular malware designed for AMD x86-64 systems and remained largely undetected for an extended period, achieving zero antivirus detection across 65 engines.

Technical Breakdown

• Malware Name: Showboat
• Type: Modular, Linux-based post-exploitation framework with standard Remote Access Trojan (RAT) capabilities, including file transfer.
• Targeted Systems: AMD x86-64 Linux environments.
• Targets: Exclusively telecommunications companies in the Middle East.
• Threat Actor: Attributed to PRC-backed threat actors.
• TTPs/Evasion:
  • Uses XOR encryption with a hardcoded key for command and control (C2) communications.
  • Disguises beacon data by embedding it within PNG file fields to evade network detection.
  • Achieved zero antivirus detection across 65 engines, indicating high stealth.
• Activity Period: Active since mid-2022.

Defense

Focus on robust network egress monitoring for anomalous traffic patterns, especially within seemingly benign protocols, and enhance host-based logging and anomaly detection for unusual process behavior on Linux infrastructure.

Source: https://www.picussecurity.com/resource/blog/showboat-malware-targeting-middle-east-telecom-firms-since-2022