Showboat Linux Malware SOCKS5 Proxy Backdoor | MSSP Advisory

Risk Assessment

Showboat is a modular Linux malware framework targeting telecommunications providers in the Middle East since mid-2022, functioning as a post-exploitation tool with remote shell capabilities, file transfer, and SOCKS5 proxy backdoor functionality. The malware creates persistent backdoor access on compromised Linux systems and enables threat actors to pivot through victim networks using proxy capabilities.

Your Linux-based monitoring infrastructure, security appliances, and client endpoint protection platforms running on Linux distributions face direct compromise risk from this post-exploitation framework. Client environments running Linux servers for critical infrastructure, network appliances, or telecommunications equipment are vulnerable to persistent backdoor access that bypasses traditional detection methods.

📬