Chinese state-aligned hackers have been using a Linux backdoor called "Showboat" to spy on telecommunications companies in Central Asia for at least four years, with multiple Chinese APT groups sharing the malware among themselves. The tool, which went undetected on VirusTotal until recently, appears designed as a practical rather than sophisticated solution for smaller market targets in countries like Afghanistan, Kazakhstan, and Azerbaijan. Security researchers believe China may be using these regions as testing grounds for their malware before deploying it against higher-value targets.