Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration
A Linux BambooToken backdoor uses MQTT on port 2883 for profiling, shell commands, and file theft.
Analysts examined a 2.4 MB Linux BambooToken sample, SHA-256 bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e, listed in Black Lotus Labs' IOC collection. After XOR-decoding a 59-byte config, it connects to broker live-hk.c2iznja.com on TCP 2883 and a hard-coded group topic, then profiles the host, runs commands via /bin/sh -c, and moves files in 128 KB chunks. Payloads use a second embedded XOR key, and the reviewed build did not enable TLS or boot persistence. Reporting links BambooToken activity to at least 2023 with targets in Asia and South America, while current broker availability was not confirmed.
- Linux sample uses MQTT broker live-hk.c2iznja.com on TCP port 2883.
- Operators can profile hosts and run commands through /bin/sh -c.
- File worker lists, uploads, downloads, and deletes files in 128 KB chunks.
- XOR obfuscation is used; reviewed build showed no TLS or boot persistence.
- Black Lotus Labs IOCs link the hash to the BambooToken campaign.
- ATT&CK
- T1071 Application Layer ProtocolT1059.004 Unix ShellT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1041 Exfiltration Over C2 Channel
- Malware
- BambooToken
- Organizations
- Black Lotus Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | live-hk.c2iznja.com | o recover two newline-separated values: the broker hostname live-hk[.]c2iznja[.]com and the hard-coded group topic {534E19D5-434B-4cad-A0C2 |
| ipv4 | 202.144.192.149 | ished. The embedded broker was historically associated with 202.144.192[.]149 . Black Lotus Labs’ IOC material recorded MQTT-related in |
| sha256 | bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e | ed with separate XOR routines. The examined sample, SHA-256 bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e , is a 2.4 MB stripped C++ executable. Its hash is listed i |
From the original article
3 min read at gbhackers.com
A Linux variant of the BambooToken backdoor uses MQTT as its command-and-control channel, enabling operators to profile compromised hosts, execute shell commands, and transfer files through broker-mediated topics. Analysis of a statically linked x86-64 ELF sample shows that its configuration, task routing, and network payloads are obfuscated with separate XOR routines. The examined sample, SHA-256 […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.