BambooToken Malware Uses MQTT to Control Windows and Linux Systems
Lumen uncovers BambooToken, a stealthy multi-platform malware using MQTT C2 and Tendyron DLL sideloading to compromise Asian and South American organizations.
Lumen Black Lotus Labs disclosed BambooToken, a previously undocumented malware family active since at least February 2023 that controls Windows and (since December 2025) Linux hosts via the MQTT protocol for C2. The malware sideloads a rogue OnKeyToken_KEB.dll via Tendyron's OnKey PKI token software, gathers host details, and uses a WMI-based plugin to enumerate installed antivirus products and exfiltrate them to C2 domains proxied through Cloudflare. A dozen compromised entities were detected across Asia and South America, and DLL sideloading plus SoftEther VPN usage suggests a China nexus.
- BambooToken active since February 2023; Linux targeting added December 2025
- Uses MQTT publish-subscribe protocol for command-and-control
- Sideloading via Tendyron OnKey software suggests China-nexus actor
- WMI plugin enumerates installed antivirus products and exfiltrates details
- Victims span finance, hospitality, biomedical and legal sectors in Asia/South America
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | c2iznja.com | on the machine and exfiltrate them to the C2 server ("api80.c2iznja[.]com"). "The domains used Cloudflare as a proxy for their infr |
| domain | chat5188.tk | gather system details and transmit them to the C2 server ("chat5188[.]tk"). In response, the server issues commands to load a plug |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.