BambooToken: The Malware That Speaks MQTT to Stay Under the Radar
Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.
Lumen Black Lotus Labs identified BambooToken, a multiplatform malware family that exchanges commands through MQTT brokers so infected hosts never contact the C2 server directly, active from at least February 2023 through July 2026. The Windows variant sideloads via Tendyron's OnKey hardware-token software used in Chinese banking and government, or impersonates Kingsoft Office, without either vendor's signing certificate being compromised; a Linux build appeared by December 2025 with shell, file transfer, and system information commands. Victims include MikroTik and DrayTek routers in Singapore, Cambodia, and Vietnam reached after internet-wide SNMP scanning, and Lumen cannot attribute the family to any known actor.
- MQTT publish-subscribe C2 hides attacker infrastructure behind a broker and is asynchronous
- Sideloading abuses signed Tendyron OnKey and Kingsoft Office binaries; no certificate compromise
- Windows plugin checks installed antivirus software every five seconds
- Dormant code includes keylogger, clipboard theft, audio recording, and webcam capture
- Only three prior malware families used MQTT: IOCONTROL, Korplug, WailingCrab
- ATT&CK
- T1071 Application Layer ProtocolT1574.002 DLL Side-LoadingT1518.001 Security Software DiscoveryT1046 Network Service Scanning
- Products
- Tendyron OnKeyKingsoft Office
- Malware
- BambooToken
- Organizations
- LumenBlack Lotus LabsVirusTotal
From the original article
6 min read at securityaffairs.com
Lumen exposes BambooToken, a stealthy malware family using MQTT and sideloading to quietly infect targets across Asia and beyond. BambooToken is a new malware family that uses MQTT, a lightweight messaging protocol commonly found in smart devices and industrial systems, to quietly control infected Windows and Linux machines. Most malware connects directly to a command-and-control […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.