BambooToken: The Malware That Speaks MQTT to Stay Under the Radar

Lumen exposes BambooToken, a stealthy malware family using MQTT and sideloading to quietly infect targets across Asia and beyond.

BambooToken is a new malware family that uses MQTT, a lightweight messaging protocol commonly found in smart devices and industrial systems, to quietly control infected Windows and Linux machines.

Most malware connects directly to a command-and-control server to receive instructions. BambooToken takes a different approach. It uses MQTT to exchange commands through a broker, making the communication less direct and potentially harder to detect.

Researchers found that the malware has been used to control compromised Windows and Linux systems and has been active since at least 2023.

“Lumen researchers at Black Lotus Labs identified a multiplatform campaign using the MQTT system for communications targeting Windows and Linux systems.” reads the Lumen report. “Based on technical artifacts, we believe this campaign was active since at least February 2023 and continued through July 2026.”

Lumen can’t tie it to any previously documented threat actor. The trail started with a routine hunt through VirusTotal early this year, where researchers spotted a newer variant they’d never seen catalogued before. Working backward from that sample led them to the whole family tree, stretching back nearly three years.

MQTT runs on a publish-and-subscribe model. Devices publish messages to named “topics,” other devices subscribe to those topics, and a central broker sits in the middle deciding who gets to hear what.

“From an attacker’s perspective, one benefit of MQTT is that it hides the rest of their infrastructure behind a broker. As a result, the compromised machine never communicates directly with the C2 server. This protocol also allows for asynchronous communication.” continues the report. “Lastly, even if a bot is infected and attempts to “subscribe” to a topic, the broker must approve it before it receives messages.”

Communication is asynchronous, too, so an infected machine can go offline for hours and pick the conversation back up without breaking anything. A broker also has to approve any subscription request before messages start flowing, giving the operator a built-in gatekeeper.

That combination explains why so few malware families bother with it. Lumen counted just three prior cases: the IoT malware IOCONTROL, the PlugX-linked backdoor Korplug, and the cybercrime tool WailingCrab. BambooToken makes four, and it’s the most fully built out of the bunch.

The earliest sample of BambooToken, from February 2023, still used plain HTTP for C2 communications. It decoded a hardcoded machine identifier, checked for a local config file, and fell back to an embedded command server if that file was missing. The commands it supported were basic: load a plugin, stop plugins, disconnect, terminate.

Between 2024 and 2025 the malware switched to MQTT and gained a sideloading trick. On Windows, it rode in through Tendyron’s “OnKey” software, a hardware-token product used across Chinese banks and government agencies to verify workstation access.

“The actor used Tendyron’s “OnKey” software to sideload agents into targeted machines. Tendyron creates hardware-based tokens employed in high-security settings to verify user identities for workstation access. Their website lists customers in China’s financial and government sectors, among other verticals.” continues the report. “Lumen assesses that neither Tendyron’s code-signing certificate nor its build environment was compromised. We suspect the actors are abusing a file vulnerable to sideloading and likely to be found natively within the targeted networks. “

One variant instead impersonated Kingsoft Office, a Microsoft Office alternative popular in China.

Neither company’s code-signing certificate was actually compromised. The malware simply exploited a legitimate, signed binary that was vulnerable to loading an attacker’s file alongside it, a technique that works precisely because nobody suspects the trusted program sitting next to it.

By December 2025, a Linux build showed up, still rough around the edges but clearly built by the same hands. It expanded the host information collected and shifted to a new set of MQTT topics. Lumen assesses with high confidence that the Windows and Linux builds share one operator.

The Linux version has a few basic command handlers. They can open a shell, upload or download files, delete files, and send system information back to the attacker. On Windows, a separate plugin checks the installed antivirus software every five seconds and sends the results back. This suggests that checking the security tools on a compromised system is one of the first steps.

The researchers also found code for features that were not active in the samples they analyzed. These included a keylogger, clipboard theft, audio recording, and webcam and screen capture. It is unclear whether these modules were ever fully developed or were simply leftover code from a shared codebase.

Some of the PE header metadata claimed the files were compiled on Windows Server 2003 using Visual Studio 2005, years before they first appeared on VirusTotal. That’s either a deliberately isolated build environment or forged timestamps, and either way it points to discipline.

“Even more striking, the actor did not forge all variables—such as the compilation timestamp—to be the same, as that itself could become a signature.” Lumen states. “Instead, they introduced some variance while keeping values within acceptable ranges.”

That’s a level of anti-forensic care you don’t see from opportunistic crews. It’s also the kind of detail that only shows up because the developer, for once, forgot to strip the dead code cleanly.

Lumen split the victims into two groups. The first is small network gear: MikroTik and DrayTek routers in Singapore, Cambodia, and Vietnam, reached after a burst of internet-wide SNMP scanning in December 2025. These devices look like actual victims rather than relay points, since the implant talks MQTT straight to the command server.

The second group is enterprise infrastructure, and it’s a mixed bag. Backend servers tied to mobile apps make up most of it, including two related to cryptocurrency, alongside a hotel in Vietnam, a biomedical firm in Argentina, a law firm in Chile, a financial company in Malaysia, and a GitLab instance in Hong Kong. A separate Vietnamese company building a wearable lifestyle device also turned up in the telemetry.

That GitLab server matters more than it might look. A compromised code repository sitting next to compromised mobile-app backends is exactly the kind of foothold that turns one intrusion into a supply-chain problem for everyone downstream.

Several infected routers routed traffic through SpeedCN, a VPN service aimed at overseas Chinese users. Lumen believes this could indicate surveillance of the Chinese diaspora rather than random infections. Another case involved a Hong Kong VPS running SoftEther, contacted by a China Mobile IP in a pattern consistent with PRC-aligned tradecraft. Lumen said it cannot attribute the activity to a specific actor, but noted similarities with techniques seen in previous operations.

Lumen’s own comparison points are telling. The report puts BambooToken’s caution and staged rollout alongside actors like Volt Typhoon, GhostEmperor, and the group behind ZuoRAT, all of which tested techniques quietly before scaling them up against harder targets. Lumen has also tracked a recent shift by PRC-aligned actors toward Latin America, and some of BambooToken’s enterprise victims sit in South America too.

“Based on our comprehensive findings, Lumen considers this threat actor highly dangerous. Using MQTT to control numerous clients from a central point, combined with routing via Cloudflare, enables large-scale operation through an unconventional communication method.” reads the report.

Two of the command domains have also cracked Cloudflare Radar’s popularity rankings at different points, which tells you this wasn’t a handful of test machines.

The advice here isn’t exotic, which is exactly the point. Map your supply chain and code dependencies properly. Keep routers patched and locked down against unsolicited SNMP traffic, with default community strings changed.

Organizations should also monitor outbound MQTT traffic when no known device or application should be using it. EDR tools should be configured to detect lateral movement, not just known malware signatures. Large outbound data transfers should also be investigated, even when the destination appears to be in a legitimate country.

None of this is new security advice. The important part is actually checking MQTT traffic instead of assuming it is coming from a harmless device like a smart coffee machine.

“With success in more discreet locations and targets, we expect the tactics, techniques and procedures (TTPs) seen here to be used in the future against more valuable or strategic targets.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

---

---