Loading story…
Researchers disclosed Showboat, a previously unreported modular Linux malware framework used since at least mid-2022 to compromise telecommunications organizations in the Middle East, Asia Pacific, and other regions. Black Lotus Labs said the malware operates as a post-exploitation backdoor that enables remote shell access, file transfer, host reconnaissance, persistence, process hiding, port mapping, and SOCKS5 proxying, allowing attackers to maintain access and pivot into internal systems not exposed to the internet. Investigators said the malware stayed largely undetected for months after a 2025 sample submission, highlighting the stealth of Linux-focused intrusions against telecom infrastructure.
Infrastructure and victimology linked the activity with moderate confidence to one or more China-aligned threat clusters, with command-and-control nodes and related IP activity tied to Chengdu, Sichuan, and domains impersonating telecom brands in Southeast Asia. Reporting also connected the broader campaign to the deployment of a Windows implant, JFMBackdoor, through DLL sideloading, suggesting a cross-platform espionage operation against telecom providers. Confirmed or suspected victims included a telecom provider in the Middle East, an ISP in Afghanistan, entities in Azerbaijan, and networks in the United States, Ukraine, and the Donbas region, reinforcing concerns that shared malware tooling is being used across multiple PRC-linked operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers said the Showboat malware campaign has been active since at least mid-2022, targeting telecommunications providers in the Asia Pacific region, the Middle East, and other regions. The activity involved telecom-themed infrastructure and post-exploitation access on Linux systems.
On 2026-05-21, Black Lotus Labs published research on a previously unreported Linux malware family named Showboat, describing it as a modular post-exploitation framework used against telecom organizations. The report linked the activity with moderate confidence to one or more PRC-aligned threat clusters and documented victims in the Middle East, Afghanistan, Azerbaijan, the United States, and the Donbas region.
Lumen reported that a Showboat malware sample submitted on 2025-05-05 remained undetected on VirusTotal through April 2026. The finding highlighted the malware's stealth and the difficulty of detecting Linux-focused intrusions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecpod.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcelumen.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos disclosed that **UAT-7290**, a threat actor active since at least 2022 and assessed with high confidence as part of the **China-nexus APT ecosystem**, has conducted sustained intrusions against high-value **telecommunications and critical infrastructure** organizations in **South Asia**, with more recent activity extending into **Southeastern Europe**. The group reportedly performs extensive pre-attack reconnaissance, then compromises public-facing edge devices through **one-day exploits**, proof-of-concept exploit adaptation, and **target-specific SSH brute force**, seeking deep and persistent access inside strategically important telecom environments. Researchers said the actor relies heavily on a **Linux-focused malware** toolkit that includes **RushDrop**, **DriveSwitch**, **SilentRaid**, and **Bulbature**, alongside overlaps with **RedLeaves** and **ShadowPad** and activity previously associated with **Red Foxtrot/APT10**. Talos assessed that UAT-7290 appears to serve a dual role: carrying out espionage while also acting as an **initial access provider** that converts compromised devices into **Operational Relay Box (ORB)** nodes for possible use by other China-linked operators. SilentRaid supports modular capabilities such as remote shell access, file management, and port forwarding, while Bulbature was tied to ORB infrastructure through a self-signed certificate observed on at least **141 hosts** in **China or Hong Kong**, reinforcing the attribution assessment.
Jun 29, 2026
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026
Chinese state-linked attackers infiltrated telecommunications providers in the Middle East after compromising internet-facing Microsoft Exchange servers, according to SentinelLABS and QGroup. The intrusions, first observed in early 2023, used webshell-based command execution to establish access and then expanded into reconnaissance, credential theft, lateral movement, and staging for data exfiltration. Researchers assessed the activity as highly likely tied to a Chinese cyberespionage actor associated with **Operation Soft Cell**, with **Gallium** judged a likely participant and possible links to **APT41** or shared tooling among Chinese state-sponsored groups. A key element of the campaign was **`mim221`**, a custom credential-theft framework derived from **Mimikatz** and built to steal credentials from **LSASS** while reducing detection opportunities. SentinelLABS said the malware chain used reflective loading, abuse of LSASS security packages, and selective termination of Windows Event Log service threads to limit forensic visibility, underscoring continued Chinese intelligence interest in regional telecom networks and a broader shift toward stealthier post-compromise tooling.
Jul 12, 2026