Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor

Showboat, a modular Linux malware targeting Middle East telecom since mid-2022, is attributed to China-linked threat actor Calypso.

• •Post-exploitation framework enabling remote shell, file transfers, and SOCKS5 proxy functionality
• •Transmits system data as Base64-encoded PNG strings while hiding from process lists
• •Uses Pastebin code snippets and SOCKS5 proxy to access non-internet-facing devices
• •Deployed with Windows implant JFMBackdoor; victims in Afghanistan, Azerbaijan, U.S., Ukraine

This summary was automatically generated by AI based on the original article and may not be fully accurate.