BambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files
The backdoor collects system information via MQTT, including host inventory, commands, files, and directory listings. It operates as a publisher-subscriber model with embedded MQTT brokers, using repeating XOR operation…
The backdoor is a Linux backdoor using MQTT to collect system information, including host inventory, commands, files, and directory listings. It was observed to operate as a publisher-subscriber model with embedded MQTT brokers. The sample includes embedded MQTT topics for secure communication and has been seen in multiple instances across different IP addresses and domains. The backdoor extracts files from a victim, decodes a configuration blob, recovers a MQTT broker address, and creates a client identifier. It operates on Windows-style paths and time values, indicating compatibility with a management design that may have originated elsewhere.