BambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files
The backdoor collects system information via MQTT, including host inventory, commands, files, and directory listings. It operates as a publisher-subscriber model with embedded MQTT brokers, using repeating XOR operation…
The backdoor is a Linux backdoor using MQTT to collect system information, including host inventory, commands, files, and directory listings. It was observed to operate as a publisher-subscriber model with embedded MQTT brokers. The sample includes embedded MQTT topics for secure communication and has been seen in multiple instances across different IP addresses and domains. The backdoor extracts files from a victim, decodes a configuration blob, recovers a MQTT broker address, and creates a client identifier. It operates on Windows-style paths and time values, indicating compatibility with a management design that may have originated elsewhere.
- Products
- BambooToken Linux Backdoor
- Victims
- host inventory collectorcommand workerfile managershell commandsfilesregular filesdownloaded datauser nameoperating-system releasemachine identifier
- Organizations
- BambooToken Linux BackdoorDomain live-hk[.]c2iznja[.]comEmbedded MQTT broker hostnameIP Address 202.144.192[.]149Network Port TCP/2883Default MQTT connection portFixed group topicmachine-identifierfile pathdirectory listings
- Countries
- cyberaisecuritythreat-actor
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | live-hk.c2iznja.com | 5da6cab Build identifier for the analysed ELF sample Domain live-hk[.]c2iznja[.]com Embedded MQTT broker hostname IP Address 202.144.192[.] |
| ipv4 | 202.144.192.149 | hk[.]c2iznja[.]com Embedded MQTT broker hostname IP Address 202.144.192[.]149 Historical resolution for the embedded broker hostname Ne |
| md5 | b4cff5f5c6088d54df434d628d2e8e57 | 8a82e3e163e5cce9b395a BambooToken Linux ELF sample hash MD5 b4cff5f5c6088d54df434d628d2e8e57 BambooToken Linux ELF sample hash GNU Build ID 65dae98336d4 |
| sha1 | 65dae98336d48a1926031c3b90d6995c25da6cab | 4d628d2e8e57 BambooToken Linux ELF sample hash GNU Build ID 65dae98336d48a1926031c3b90d6995c25da6cab Build identifier for the analysed ELF sample Domain live-hk |
| sha1 | bed2b7acb36e01bf82e8a82e3e163e5cce9b395a | 3a835f8f01b2861b926 BambooToken Linux ELF sample hash SHA-1 bed2b7acb36e01bf82e8a82e3e163e5cce9b395a BambooToken Linux ELF sample hash MD5 b4cff5f5c6088d54df434 |
From the original article
4 min read at cybersecuritynews.com
BambooToken is a Linux backdoor that turns a lightweight messaging protocol into a remote control channel. The newly analysed sample can collect information about a host, run shell commands, and move files between a compromised machine and its operator. Its use of MQTT is notable because the protocol is common in connected-device environments and uses […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.