Showboat: A Modular Linux Backdoor Quietly Camped in a Middle East Telco Since 2022

A Linux post-exploitation framework called Showboat has been sitting inside a Middle Eastern telecommunications operator since at least mid-2022, used by an as-yet-unattributed operator to maintain remote shell access, move files, and tunnel traffic through the carrier's own infrastructure as a SOCKS5 proxy. The framework was disclosed by Black Lotus Labs at Lumen, which describes it as modular, ELF-based, and built specifically to live on carrier-grade Linux without tripping endpoint telemetry that most telcos don't run on this class of host in the first place.

Showboat is not a vulnerability story in the CVE sense. There is no advisory page to point at, no CVSS score, no patched build. It is an implant, and the interesting bits are in how it loads and how it speaks to its operator.

How the bug works

The loader stages Showboat entirely in memory. The dropper decrypts an embedded ELF blob, maps it with mmap using PROT_READ|PROT_WRITE|PROT_EXEC, resolves imports against the live process, and jumps to the payload's entry point without ever writing the second-stage binary to disk. That alone defeats most file-integrity monitoring on a typical Red Hat or Oracle Linux box. The framework is genuinely modular: separate components handle the reverse shell, the file transfer channel, and the SOCKS5 proxy, and operators can load or unload them on a live infection. The SOCKS5 module is the one that matters operationally. A telco backbone host running a SOCKS5 listener is, for an intelligence operator, an extremely attractive jump point, because outbound traffic from that host is indistinguishable from the carrier's own.

Black Lotus Labs has not publicly attributed Showboat to a named cluster. The targeting profile, single regional telecommunications provider, multi-year dwell, no destructive payload, fits the pattern of an espionage operator running long-haul access rather than a financially motivated crew. The team's writeup notes overlap in tradecraft with previously reported Linux implants used against telecom and ISP networks in South and Central Asia, but stops short of naming a group.

And here is the awkward part. Showboat's persistence does not rely on a kernel rootkit or a fresh privilege escalation. It relies on the fact that nobody is looking. Long-lived Linux servers in carrier environments rarely get EDR, rarely get rebooted, and rarely get their /tmp and /dev/shm regions audited. The implant is competent, but it is not exotic. It works because the monitoring isn't there.

Lumen says it has null-routed the known command-and-control infrastructure across its own backbone. The C2 is down. The visibility gap that let Showboat run for three years is not.