Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration
A Linux BambooToken backdoor uses MQTT on port 2883 for profiling, shell commands, and file theft.
56
Malware
BambooToken
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 16, 2026
- Last mentionedSep 22, 2026
Timeline
2 articles · newest firstBambooToken: The Malware That Speaks MQTT to Stay Under the Radar
Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.
56
Appears with
- Black Lotus Labsorganization · 2
- Kingsoft Officeproduct · 1
- DrayTekvendor · 1
- MikroTikvendor · 1
- Kingsoftvendor · 1
- Lumenorganization · 1
- Tendyron OnKeyproduct · 1
- Tendyronvendor · 1
- VirusTotalorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.