BambooToken malware controls Windows and Linux systems via MQTT

Summary

A new malware framework named BambooToken, active since at least 2023, has been observed using the MQTT protocol for command-and-control communications. This technique allows for evasion and resilience by avoiding direct connections to attacker infrastructure. Variants have been developed for both Windows and Linux, with observed targets including mobile app servers, legal and financial services, and software development, primarily in Asia and South America.

Full text

BambooToken malware controls Windows and Linux systems via MQTT By Bill Toulas September 15, 2026 11:00 AM 0 A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. The malware adopted MQTT for command-and-control communications in variants developed between 2024 and 2025, compromising servers used by mobile apps, legal and financial services, and software development. MQTT is a lightweight messaging protocol primarily designed for IoT (Internet of Things) devices. It relies on a central broker and channels called “topics” to relay messages from publishers to subscribers, rather than using direct communication channels. While MQTT is not novel, it is an uncommon approach, and researchers at cybersecurity company ESET documented an unrelated backdoor called MQsTTang in 2023. In the case of BambooToken, the infected machine subscribes to topics associated with a unique identifier. The attacker then publishes to those topics the commands to be executed on infected hosts. The malware publishes status and system information through the broker and receives operator instructions through subscribed topics. Hardcoded Topics in the malware codeSource: Lumen This approach has the advantage that infected systems do not connect directly to the attacker’s infrastructure, which increases evasion and resilience. At the same time, communications can be asynchronous, ensuring operational continuity during temporary network disruptions. A report today from Lumen's research arm, Black Lotus Labs, notes that BambooToken infected systems by side-loading via a digitally signed Tendyron OnKey USB-token software or by impersonating the Kingsoft Office productivity suite. The researchers recovered a BambooToken plugin that enumerates antivirus products on infected hosts and returns the results to the C2. They also found strings pointing to keylogging, clipboard theft, audio recording, webcam capturing, and screenshot capturing. However, they retrieved these details from “dead code,” meaning the researchers cannot confidently determine if the referenced modules existed and were used in attacks or were still under development. Strings found in dead code section of .rdata fileSource: Lumen The researchers found a Linux variant of the malware, BambooToken version 2.1, as the most recent one (observed in December 2025) that could be linked to the campaign It also uses MQTT, collects extensive system information, can spawn a command shell, and allows operators to upload, download, and delete files. However, Black Lotus Labs says that "the Linux sample still appeared to be under development." Lumen’s telemetry identified approximately a dozen compromised enterprise entities, mostly in Asia and South America, including hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency website in Lithuania. Additionally, the researchers found that the most compromised servers were associated with the backend infrastructure of mobile applications. The threat actor also compromised a GitLab server in Hong Kong, creating a potential foothold for supply-chain attacks. Lumen hypothesizes that some of the activity may have targeted overseas Chinese users accessing mainland services through the SpeedCN VPN service. Although the researchers could not attribute BambooToken activity to a specific threat actor or a known activity cluster, they note that the targeting patterns are consistent with China-aligned operations. Lumen has shared indicators of compromise (IoCs) associated with this activity to help defenders detect and block the attacks. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: New ClickLock macOS malware traps users into revealing login passwordHackers exploit Tencent app flaw to deploy GrayRabbit malwareArtifactory flaws chained in attacks deploying backdoor malwareMFA's Weakest Link: Account Recovery Is the New Attack PathHackers breach F5 BIG-IP APM devices to deploy Linux rootkit

Indicators of Compromise

• malware — BambooToken
• malware — MQsTTang

Entities