A newly identified Linux malware family, referred to as Showboat, has been linked to persistent cyber campaigns against international telecommunications firms. Discovered by Black Lotus Labs, Showboat has been operational since mid-2022 and operates as a modular post-exploitation framework, allowing attackers to spawn remote shells, transfer files, and function as a Socks5 proxy. It has been associated with activity clusters reportedly aligned with the People's Republic of China (PRC), affecting telecom providers in the Middle East and impersonating firms in Southeast Asia.