Showboat/kworker Masquerading as Linux Kernel Worker Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the Showboat Linux malware which hides its presence by masquerading as a kernel worker process. This is identified by a process with 'kworker' in its name or command line that originated from a resolvable on-disk binary path, which is characteristic of user-space processes rather than legitimate kernel threads.