Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration

A Linux variant of the BambooToken backdoor uses MQTT as its command-and-control channel, enabling operators to profile compromised hosts, execute shell commands, and transfer files through broker-mediated topics.

Analysis of a statically linked x86-64 ELF sample shows that its configuration, task routing, and network payloads are obfuscated with separate XOR routines.

The examined sample, SHA-256 bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e, is a 2.4 MB stripped C++ executable.

Its hash is listed in Black Lotus Labs’ BambooToken IOC collection, linking the file to the published multi-platform campaign rather than identifying an operator solely from protocol or filename overlap.

BambooToken’s C2 bootstrap is contained in a 59-byte configuration blob.

At startup, the malware applies a single-byte XOR operation, using the final byte as the key, to recover two newline-separated values: the broker hostname live-hk[.]c2iznja[.]com and the hard-coded group topic {534E19D5-434B-4cad-A0C2-8D75E0B2FBFC}.

The implant then creates a UUID-shaped client identifier for the individual victim. This division lets attackers broadcast an instruction through the shared group while addressing host-specific tasks through a per-client topic.

The connection wrapper defaults to TCP port 2883 and registers an MQTT last-will message indicating that the victim has gone offline. Failed connections trigger retries after 15 seconds.

The sample also includes an -i option that invokes a double-fork daemonization routine. It detaches from the terminal, creates a new session, changes its working directory to /, and sets the umask to zero.

However, the binary does not establish a boot-time persistence mechanism, so daemonization alone should not be treated as evidence of reboot persistence.

The main BambooToken client subscribes to the fixed group topic, its generated client ID, and additional topic names associated with plugin and Lua functionality.

Only the host inventory, shell, and file-management paths were implemented in the inspected dispatcher.

An ONLINE request issued on the group topic triggers host profiling. The response includes the current username, hostname, OS-release information, machine ID, MAC address, local IPv4 address, CPU model, process ID, and thread ID.

Several inventory fields are static placeholders rather than collected values, including mem, ver, and some Linux-labelled product metadata.

Reverser said in a report shared with GBhackers, BambooToken activity dating to at least 2023, with targets across Asia and South America and MQTT-based C2 appearing in newer variants.

Linux BambooToken Malware

A SHELL request starts a dedicated shell worker that listens on <client-id>/Shell and returns data through <client-id>/Shell/Resp.

The worker accepts JSON commands and sends them to popen(), ultimately invoking /bin/sh -c. Each instruction launches a separate shell command rather than creating a persistent pseudo-terminal session.

Output is collected in 1,024-byte line buffers, meaning standard error is returned only if the operator redirects it into standard output.

The FILEEX path launches a file worker using <client-id>/File and <client-id>/File/Resp. It supports directory listings, uploads, downloads, deletion, stopping, and exit operations.

Directory listings use an unusual protocol field named flies, a typo that may help defenders recognize decoded BambooToken traffic.

BambooToken uses a second, repeating XOR key for MQTT payloads:

+0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ

Topics are transformed differently. Each slash-separated segment is XORed from the beginning of the key and converted to lowercase hexadecimal, while slash delimiters and MQTT wildcards remain visible.

For example, ONLINE becomes 647e7d7b7d71, while /Shell becomes /7858545e5f.

The transformation may complicate superficial inspection, but it does not provide meaningful confidentiality because the key is embedded in the binary.

The reviewed connection path also did not show a TLS configuration call, increasing the value of network detection based on suspicious MQTT use, unusual port 2883 traffic, and encoded topic structures.

For file exfiltration, BambooToken sends data in 128 KB chunks. Each chunk contains JSON metadata such as path, transfer ID, size, and offset followed by a NUL separator and raw file bytes. The full buffer is subsequently XOR-obfuscated before publication.

Uploads reverse the process and write data to the requested path and offset; no automatic execution of uploaded payloads was established.

The embedded broker was historically associated with 202.144.192[.]149. Black Lotus Labs’ IOC material recorded MQTT-related infrastructure observations involving the hostname and TCP port 2883, while a public sandbox entry for the same SHA-256 reportedly observed resolution and a connection attempt to that destination.

Those records are historical indicators, not confirmation that the hostname, address, or broker remains active today.

For defenders, the strongest detection opportunities are outbound MQTT from Linux servers, connections to TCP 2883, UUID-like client topics, the shared BambooToken group identifier, and XOR-decoded payloads containing ONLINE, SHELL, FILEEX, command, or the distinctive flies field.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC