A previously undocumented, modular Linux post‑exploitation framework that demonstrates sophisticated stealth techniques most notably fetching and compiling C code hosted on Pastebin to hide processes at runtime.
Active since mid‑2022 and aimed at AMD x86‑64 Linux hosts, Showboat remained undetected by antivirus until April 2026, registering zero detections across 65 engines as recently as May 2025.
Targeting has been narrow and consistent: telecommunications companies in the Middle East. Black Lotus Labs attributes the framework with moderate‑to‑high confidence to PRC‑linked actors based on command‑and‑control (C2) infrastructure ties to Chengdu and behavioral overlap with known Chinese APT toolsets.
Technically, Showboat is an ELF 64‑bit executable that begins operation by retrieving an encrypted configuration from its C2. The config uses trivial XOR encryption with a hardcoded key (“look me, AV!”), a simple scheme that nevertheless evaded signature detections because the payload retrieval and packaging avoid persistent, obvious artifacts.
The decrypted configuration exposes C2 endpoints, porting, and randomized beacon timing parameters (min/max sleep and a slower “stealth” mode), which frustrate detection by removing rigid periodic network patterns.
Black Lotus Labs said in a report shared with GBhackers , Showboat is not a one‑shot dropper or destructive ransomware; it is a persistent remote access platform designed for long‑term, low‑noise footholds inside high‑value networks.
After configuration, Showboat assembles a detailed heartbeat: host metadata (hostname, OS release), process listings, its own process metadata, and even a screenshot.
This telemetry is JSON‑formatted, partially encrypted with UUID‑derived material, base64 encoded, and then embedded inside a PNG field before exfiltration .
Packing beacon data into benign‑looking image structures is an effective evasion: many network inspection pipelines do not treat PNG ancillary fields as likely carriers for command traffic, allowing the beacon to blend with legitimate image traffic.
Operator control is achieved through a typical RAT command set file transfers, directory operations, and persistence but Showboat’s standout capability is its process‑hiding command.
When instructed to hide, the framework downloads a C source file from a Pastebin raw page , compiles it locally into a shared object, and abuses the ld.so.preload mechanism to force early loading of that library into process address spaces.
The injected library hooks directory and process enumeration functions (for example, readdir and related calls) and filters out process names present on a hardcoded list (examples recovered include entries like “kworkers|dbus|autoupdate”), preventing common system utilities from listing targeted processes.
This on‑host compilation workflow fetch source from a public paste service, compile with gcc, and persist via /etc/ld.so.preload is notable because it moves malicious implementation into ephemeral, easy‑to‑modify code hosted offsite.
That gives operators flexibility and reduces the binary footprint shipped with the initial implant, increasing its ability to evade static detection. The use of a paste service also complicates attribution and takedown, since operators can swap code fragments rapidly.
For defenders, Showboat highlights several practical mitigations. Monitor and alert on unexpected usage of gcc and creation of shared objects in temporary directories; watch writes to /etc/ld.so.preload and unexpected entries in loader configuration; inspect PNG payloads and ancillary fields when images traverse perimeter proxies; and enforce egress filtering to known malicious paste and C2 hosts.
Endpoint detection should include heuristics for in‑memory function hooks and rapid compilation activity on productive hosts.
Picus Security has added Showboat simulations to its Threat Library across Network Infiltration and Email Infiltration modules, enabling organizations to validate controls against the framework’s behavior and to exercise detection of its unique indicators (XOR config transfers, PNG‑embedded beacons, Pastebin‑sourced C code, and ld.so.preload abuse).
Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.
A critical security flaws in widely used Chrome extensions, exposing millions of users to the…
A serious security vulnerability has been uncovered in the widely used Avada (Fusion) Builder WordPress…
A recently disclosed vulnerability inc, which affects UEFI applications signed by multiple vendors, has prompted…
A supply-chain style compromise in the Okendo Reviews widget that enabled the SmartApeSG threat actor…
HazyBeacon is a stealthy cloud-native malware campaign identified as CL-STA-1020. It is exploiting Amazon Web…
CISA has issued an urgent alert regarding a critical vulnerability in Splunk Enterprise, tracked as…
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
