BambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files

BambooToken is a Linux backdoor that turns a lightweight messaging protocol into a remote control channel. The newly analysed sample can collect information about a host, run shell commands, and move files between a compromised machine and its operator.

Its use of MQTT is notable because the protocol is common in connected-device environments and uses a broker to relay messages.

Reverser analysts identified the implant after decoding a small embedded configuration block and tracing its MQTT callbacks.

Reverser said in a report shared with Cyber Security News (CSN) that the sample contains a host inventory collector, a command worker, and a file manager connected through encoded MQTT topics.

The analysis does not establish initial access, delivery method, an operator, or a victim campaign. Once placed on a Linux system, however, the backdoor could give an intruder practical access to system details, command output, and locally stored data.

BambooToken Linux Backdoor Uses MQTT C2

At launch, BambooToken decodes a 59-byte configuration blob to recover an MQTT broker address and a fixed group topic. It then creates a UUID-like client identifier for the running process.

The program connects to its configured broker over TCP port 2883 and retries after failures with a 15-second delay. It also registers an offline status message, a feature that can help track an infected system.

The control client listens for messages on the group topic, its client identifier, and several additional topic names. Separate workers handle shell and file requests.

This publish-and-subscribe design resembles techniques discussed in reporting on MQTT messaging protocol abuse, where a broker can separate the attacker from the directly managed endpoint.

BambooToken hides both its payloads and topic labels with a repeating XOR operation. The encoding can make quick inspection harder, but offers no strong protection once the key is known. Analysts should treat unusual MQTT sessions from Linux servers as a lead rather than proof of compromise.

A shell request accepts JSON carrying an operation named command and passes the supplied text to the system shell through /bin/sh -c. Output is read in 1,024-byte lines and returned to the controller. Each request launches a separate command, rather than creating a persistent interactive terminal.

This capability gives an intruder a flexible way to inspect the system, collect results, or prepare later actions. It also underlines why defenders investigating suspicious command execution should examine network context, a pattern also seen in remote MQTT control malware.

File Control and Detection

The file component can list directories, download files from the victim, upload content, and delete regular files. Downloaded data is sent in 128-KiB chunks, with a JSON header separated from the raw file bytes by a NUL character.

A parser that expects an entirely JSON message could miss the transferred content. Directory listings contain a misspelled field, flies, alongside file names, types, sizes, and timestamps. That unusual protocol detail may help analysts recognize decoded traffic.

The sample also adjusts Windows-style paths and uses Windows-style time values, suggesting compatibility with a management design that may have originated elsewhere.

When it receives an ONLINE request, BambooToken gathers the username, hostname, operating-system release, machine identifier, network details, processor model, and process information.

It tries /etc/machine-id first and can fall back to a path under /var/lib/myapp, which may offer a useful correlation point during an investigation.

Defenders should hunt for unfamiliar Linux ELF files that connect to the listed broker or historical address on port 2883, then correlate those events with child /bin/sh -c processes and unexpected file access.

Encoded MQTT topics, the flies field, and data split at a NUL byte can strengthen a detection. Similar backdoor activity has appeared in coverage of MQTT enabled malware operations, but port use alone remains weak evidence.

Organizations should restrict unnecessary outbound MQTT traffic, log broker connections, preserve relevant network captures, and isolate suspected hosts before collecting volatile evidence.

Since the reported address is historical, responders should validate current resolution and connectivity rather than assuming the infrastructure is still active.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926	BambooToken Linux ELF sample hash
SHA-1	bed2b7acb36e01bf82e8a82e3e163e5cce9b395a	BambooToken Linux ELF sample hash
MD5	b4cff5f5c6088d54df434d628d2e8e57	BambooToken Linux ELF sample hash
GNU Build ID	65dae98336d48a1926031c3b90d6995c25da6cab	Build identifier for the analysed ELF sample
Domain	live-hk[.]c2iznja[.]com	Embedded MQTT broker hostname
IP Address	202.144.192[.]149	Historical resolution for the embedded broker hostname
Network Port	TCP/2883	Default MQTT connection port
MQTT Group Topic	{534E19D5-434B-4cad-A0C2-8D75E0B2FBFC}	Fixed group topic embedded in the sample
Encoded MQTT Topic	647e7d7b7d71	Computed wire representation for ONLINE
Encoded MQTT Topic	6476777e7a7a70	Computed wire representation for OFFLINE
Encoded MQTT Topic	/7858545e5f	Computed wire representation for /Shell
Encoded MQTT Topic	/6d595d57	Computed wire representation for /File
Encoded MQTT Topic	/79554242	Computed wire representation for /Resp
File Path	/var/lib/myapp/machine-id	Fallback machine-identifier storage path used by the implant

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC