Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration
A Linux BambooToken backdoor uses MQTT on port 2883 for profiling, shell commands, and file theft.
Analysts examined a 2.4 MB Linux BambooToken sample, SHA-256 bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e, listed in Black Lotus Labs' IOC collection. After XOR-decoding a 59-byte config, it connects to broker live-hk.c2iznja.com on TCP 2883 and a hard-coded group topic, then profiles the host, runs commands via /bin/sh -c, and moves files in 128 KB chunks. Payloads use a second embedded XOR key, and the reviewed build did not enable TLS or boot persistence. Reporting links BambooToken activity to at least 2023 with targets in Asia and South America, while current broker availability was not confirmed.
- Linux sample uses MQTT broker live-hk.c2iznja.com on TCP port 2883.
- Operators can profile hosts and run commands through /bin/sh -c.
- File worker lists, uploads, downloads, and deletes files in 128 KB chunks.
- XOR obfuscation is used; reviewed build showed no TLS or boot persistence.
- Black Lotus Labs IOCs link the hash to the BambooToken campaign.
Coverage timelineoldest first · each row is one article
- · 4d agoLinux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration
GBHackers· 56
A Linux BambooToken backdoor uses MQTT on port 2883 for profiling, shell commands, and file theft.
- · 4d agoBambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files
Cyber Security News· 50
The backdoor collects system information via MQTT, including host inventory, commands, files, and directory listings. It operates as a publisher-subscriber model with embedded MQTT brokers, using repeating XOR operation…