Showboat Linux Malware Turns Telecom Servers Into Hidden SOCKS5 Proxy Backdoors

Recent threat intelligence details Showboat, a Linux-based post-exploitation malware framework tied to a telecommunications espionage campaign. The activity has been observed against a telecom provider in the Middle East for at least a multi-year window, beginning no later than the earlier part of the previous period, with continued operational use indicated by infrastructure and tooling patterns.

What Showboat Is and Why It Matters

Showboat is a modular framework designed for Linux systems after initial compromise. Rather than focusing on disruption, it supports long-term intrusion goals through capabilities that enable remote control, internal network access, and stealthy data handling.

The most consequential feature is the ability to function as a SOCKS5 proxy. Once installed, compromised Linux servers can be used as pivot points for reaching systems deeper in the network, including resources that may otherwise be shielded by perimeter controls and segmentation.

Observed Targeting: Telecommunications Infrastructure

Victims identified in reporting include telecom and internet service providers with confirmed impacts in regions such as Afghanistan and Azerbaijan. Additional suspected victims have been mentioned in the United States and Ukraine. While the exact initial access method is not fully disclosed, the targeting pattern reflects a strong emphasis on high-value communication networks where intelligence value is high.

Operational Attribution Signals

Infrastructure analysis in the public reporting points to Chinese state-aligned threat actor activity. Command-and-control elements were geolocated to Chengdu, Sichuan. Overlapping tactics and tooling have been linked to Calypso APT, a group known for telecommunications-focused espionage.

Technical Capabilities Used During Intrusion

Showboat’s feature set supports both control and evasion. Key capabilities include:

• SOCKS5 Proxy Support: Converts an infected host into a tunnel for internal reconnaissance and access.
• Remote Shell: Allows execution of arbitrary commands on compromised systems.
• File Transfer Operations: Enables uploading and downloading tools or data.
• Process Hiding: Uses stealth techniques resembling rootkit behavior, including fetching code snippets from paste-style hosting sites.
• Data Encoding for C2 Traffic: System information is encrypted and then represented using Base64 patterns embedded into fields that appear to carry benign content.

A particularly notable evasion approach is the use of PNG-related fields to mask command-and-control content. By making exfiltration artifacts resemble innocuous image-structured data, the traffic can become harder to detect using basic deep packet inspection or simplistic data loss prevention rules.

Why the SOCKS5 Proxy Is a High-Impact Feature

In telecommunications environments, the internal network is often filled with systems that hold sensitive operational and customer-related information. A SOCKS5 pivot changes the threat model:

• Persistent internal access: Compromised edge servers become stable gateways into internal segments.
• Bypassing east-west monitoring gaps: Traffic originating from a “trusted” internal system may appear more normal than direct attacker connections.
• Reduced need for re-compromise: The proxy enables continued access without re-establishing footholds.
• Target expansion: The same tunnel can be used to reach billing systems, customer databases, and other core operational tooling.

Cross-Platform Tooling in the Same Campaign

Public reporting indicates that the campaign is not limited to Linux. Related tooling includes Windows malware families described as EvaRAT and JFMBackdoor. These Windows components also support remote shell functionality, file operations, proxying behavior, and in some cases additional surveillance capabilities such as screenshots. The use of multiple platforms suggests a strategy aligned with heterogeneous telecom environments where Linux and Windows systems coexist.

Common Defensive Actions for Telecom Security Teams

Organizations with telecom and ISP operational networks can reduce exposure by focusing on both behavioral detection and infrastructure hygiene.

1. Hunt for SOCKS5 anomalies: Look for unexpected proxy listeners or proxy-like outbound behaviors from Linux hosts that do not normally provide tunneling services.
2. Inspect for hidden process behavior: Validate process visibility using multiple system viewpoints, including comparisons between process listings and filesystem indicators.
3. Monitor suspicious “image-like” payloads: Review egress patterns that include structured fields consistent with PNG-masked data transport.
4. Control paste-site and code-fetch behavior: Block or tightly monitor production systems fetching code from paste-style hosting services.
5. Harden remote management access: Patch exposed services, eliminate default credentials, and enforce multi-factor authentication on administrative portals.
6. Apply IOC-driven detection: Use the indicators published in related reporting to identify known command-and-control endpoints, certificates, and hashes.

Key takeaway: Showboat is best described as a stealth and persistence implant for espionage. Its SOCKS5 proxy capability turns compromised telecom Linux servers into covert internal gateways, enabling long-term intelligence collection and lateral access across protected network zones.