Introduction

Researchers at Black Lotus Labs, the threat intelligence division of Lumen Technologies, have publicly disclosed BambooToken, a cross-platform malware family (Windows and Linux) whose most distinctive trait is its use of the MQTT (Message Queuing Telemetry Transport) protocol as a Command and Control (C2) channel. According to the researchers’ assessment, the campaign has likely been active since at least February 2023, with activity detected as recently as July 2026, and has compromised organizations primarily in Southeast Asia and, to a lesser extent, in South America. By relying on a protocol originally designed for IoT device and industrial infrastructure telemetry — rather than the HTTP/HTTPS or DNS channels that draw the bulk of perimeter security scrutiny — BambooToken’s operators manage to blend their communications in with legitimate sensor, wearable, and telemetry traffic, making detection difficult for several years.

What is BambooToken and the MQTT protocol? (General Analysis)

MQTT (Message Queuing Telemetry Transport) is a lightweight messaging protocol based on a publish/subscribe model, designed in the late 1990s to operate with minimal bandwidth consumption on high-latency or low-reliability networks. For that reason, it has become a de facto standard in:

  • Consumer IoT devices (home automation, wearables, smartwatches).
  • Industrial control systems and OT/SCADA environments, where remote sensors report telemetry at regular intervals.
  • Messaging applications and connected vehicle fleets.

Its architecture consists of three elements: publishers (which send messages), subscribers (which receive them), and a central broker that acts as an intermediary, distributing each message according to the “topic” (thematic channel) it was published to.

From an attacker’s perspective, adopting MQTT as a C2 channel offers several tactical advantages:

  • Decoupling from the real infrastructure: the compromised host never communicates directly with the operator’s server, only with the broker, which hides the C2 infrastructure behind an additional layer.
  • Asynchronous communication: messages can be delivered with delay without breaking the operation, which is useful in the event of network interruptions or intermittently connected victims.
  • Low historical visibility: most corporate traffic inspection tools (proxies, next-generation firewalls, IDS) are tuned for HTTP(S), DNS, and SMTP; MQTT traffic rarely receives the same level of scrutiny, especially on networks without declared IoT infrastructure.
  • Implicit subscription approval: the broker must accept the subscription to a topic before the bot receives instructions, which adds a layer of operational control for the attacker.

It is worth noting that this abuse is not unprecedented, though it is uncommon. Previously documented cases include the MQsTTang backdoor, attributed to the Chinese group Mustang Panda; the Tizi Android malware; the WailingCrab loader (also known as WikiLoader); the IOCONTROL OT/IoT malware (or OrpaCrab), aimed at SCADA systems in Israel and the United States; and a variant of Korplug/PlugX. BambooToken adds to this short but growing list of campaigns that weaponize a telemetry protocol for malicious purposes.

How does it work?

Initial compromise vector

The initial delivery mechanism (phishing, supply chain, exposed remote access, etc.) has not been determined with certainty by the researchers. What has been documented is the local execution mechanism:

  • The oldest variant (2023) was launched via a PowerShell script acting as a stager, reserving memory and injecting the malicious binary into the process.
  • Later versions (2024–2025) rely on DLL side-loading: the operators abuse a legitimate, digitally signed binary — the “OnKey” software from Tendyron, a USB cryptographic token (PKI) widely used in the Chinese banking and government sector for high-security authentication — to load a malicious DLL (OnKeyToken_KEB.dll). The researchers clarify that there is no evidence that Tendyron’s code-signing certificate or build environment was compromised; the legitimate binary was simply vulnerable to the sideloading technique.
  • An additional variant was identified that impersonates the Chinese office software Zhuhai Kingsoft Office, using a trust-spoofing technique previously documented by SpecterOps.

(Note on vendor figures: Tendyron states on its website that it has 190 million tokens in circulation; this is a figure declared by the manufacturer itself and not an independently verified data point by the researchers.)

Persistence and host information gathering

  • The agent uses a mutex derived from a hardcoded GUID (obfuscated via XOR) to prevent multiple instances from running simultaneously on the same machine.
  • It looks for a configuration file (OnKeySrv.dat) that contains the encrypted C2 server address; if it does not find it, it falls back to a hardcoded C2 embedded in the binary.
  • Information gathering evolved across versions: from basic data (architecture, CPU, RAM, public IP address obtained via icanihazip.com, MAC address) to extensive enumeration via WMI (Windows Management Instrumentation) in the more recent variants: operating system, serial number, product key, licensing information, BIOS, computer name, process PID/TID, among others.
  • Analysis of “dead code” (unexecuted fragments that remain in the compiled binary) revealed strings suggesting keylogging, clipboard capture, audio recording, and webcam and screen capture functionality. It is important to note that the researchers themselves could not confirm whether these capabilities were ever actually implemented and actively used, or whether they correspond to abandoned development or an incompletely linked static library. This is therefore a possible future or historical capability, not a confirmed functionality in real-world campaigns.

C2 communication mechanics over MQTT

This is BambooToken’s distinctive core. The typical flow observed by the researchers is as follows:

  1. After extracting (or generating) its C2 address and unique GUID, the agent subscribes to a set of “topics”: a global broadcast topic (“Global”) and between three and four additional topics derived from the host’s GUID, with names such as {GUID}/Plugin, {GUID}/removePlugin, {GUID}/LUA, or {GUID}/unPlugin (the exact naming varies depending on the version analyzed).
  2. The agent publishes a brief JSON message to the global broadcast topic indicating its status (online/offline) along with its GUID (gid), acting as a heartbeat.
  3. The agent waits, with a timeout of approximately 60 seconds, for a response distributed by the broker on one of its subscribed topics; if it does not receive one, it goes to sleep (~15 seconds) and repeats the cycle.
  4. C2 responses include a header with a command identifier, size, and payload. Identified commands include: no-op, load a new plugin, stop all plugins, terminate execution, and disconnect from the C2.
  5. Three specific command handlers were identified: SHELL (spawns a thread that opens a remote command shell), FILEEX (allows uploading, downloading, and deleting files, as well as stopping or closing execution), and ONLINE (periodically collects and transmits host parameters as a heartbeat).
  6. According to Lumen’s assessment, the malware uses the open-source Eclipse Mosquitto library as its MQTT client.
  7. Additionally — and this is relevant because it qualifies the “pure” use of MQTT — one of the identified plugins (antivirus product enumeration via WMI) exfiltrates its results via a simple HTTP GET request to a separate endpoint, indicating a hybrid exfiltration scheme rather than an exclusive reliance on the MQTT protocol.
  8. The C2 domains are hidden behind Cloudflare as a reverse proxy, adding an additional layer of indirection over the real infrastructure.

Affected Systems and Environments

  • Windows: the family’s original platform, documented since 2023, with the most mature infection chain (sideloading, extensive WMI enumeration, antivirus plugin).
  • Linux (ELF binaries): the most recent variant, first observed in December 2025. According to the researchers themselves, this sample “still appeared to be under development,” since only one of its three initialization arguments had an implemented function; even so, it already features a remote shell, file transfer/deletion, and extensive host data collection.
  • Edge network infrastructure (SOHO routers): within the same activity cluster, Lumen documented a separate group of devices — mainly MikroTik and DrayTek routers geolocated in Singapore, Cambodia, and Vietnam — with persistent connections to the same C2 nodes over the MQTT port. The researchers treat these as a distinct victim population (“individual or small-network infrastructure”), likely compromised through mass scanning targeting the SNMP service.

Organizational profiles with the highest exposure, according to Lumen’s telemetry:

  • Chinese financial and government institutions that rely on Tendyron OnKey-type USB cryptographic tokens for access control.
  • Software development companies and DevOps teams: a compromised GitLab server in Hong Kong was identified, introducing a supply-chain risk.
  • Mobile application backends (the most represented category among compromised servers), including cryptocurrency, chat, and wellness/lifestyle apps.
  • The hospitality sector (a hotel in Vietnam), biomedical (a company in Argentina), legal (a firm in Chile), financial (an organization in Malaysia), and a cryptocurrency site in Lithuania.
  • Members of the Chinese diaspora abroad who use VPN services such as “SpeedCN” to access mainland Chinese applications and content, suggesting a possible interest in analyzing the pattern-of-life of that population.

(Confidence note: attribution of the actor to a Chinese nexus is based on indirect indicators — the geographic origin of samples uploaded to VirusTotal, use of a “SoftEther” VPN from Hong Kong, and partial TTP overlap with clusters such as Volt Typhoon or the ZuoRAT operator — but the researchers themselves are unable to link the campaign to any specific known group. This is a moderate-confidence hypothesis, not a confirmed attribution.)

Mitigation and Detection

Immediate remediation

  • Immediately isolate any endpoint where associated artifacts are identified: the OnKeyToken_KEB.dll file loaded via sideloading, OnKeySrv.exe processes exhibiting anomalous behavior, or binaries impersonating Kingsoft Office without a valid signature.
  • Revoke and rotate potentially exposed credentials, certificates, and access tokens, paying special attention to environments that use high-security USB cryptographic tokens for workstation authentication.
  • Conduct a supply chain review (GitLab repositories, CI/CD pipelines, third-party dependencies) given the possibility that development credentials or build artifacts may have been exposed.
  • Harden SOHO routers (MikroTik, DrayTek, or others): disable internet-exposed SNMP, replace default community strings, and apply pending firmware updates.
  • Audit WMI logs for unusual enumeration queries targeting installed antivirus products, a behavior associated with the plugin identified in this campaign.

Detection and monitoring for defenders

  • Inspect outbound MQTT traffic, both on the conventional ports — 1883 (unencrypted) and 8883 (TLS/SSL) — and on non-standard ports; in this campaign, connections labeled as MQTT were also observed on port 2883. Any connection to external brokers not authorized by the organization warrants immediate review, especially if the originating device is not part of a declared IoT deployment.
  • Since an attacker can use arbitrary ports, it is advisable to complement port-based filtering with protocol signature-based detection (identifying MQTT CONNECT/CONNACK/PUBLISH/SUBSCRIBE packets regardless of port).
  • Create IDS/IPS signatures (Suricata/Snort) targeting:
    • MQTT handshakes directed at IP addresses outside an allowlist of known IoT brokers.
    • Topic naming patterns such as {GUID}/Plugin, {GUID}/removePlugin, or {GUID}/LUA.
    • Short, repetitive JSON payloads with the "op" and "gid" fields, characteristic of this malware’s heartbeat mechanism.
  • Correlate network telemetry with the indicators of compromise (IoCs) published by Black Lotus Labs. For reference (observation window: approximately January–July 2026; it is recommended to cross-check them against Black Lotus Labs’ public, updated feed before blocking, since the C2 infrastructure rotates over time):
    • Domains: chat5188[.]tk (historical 2024 cluster) and its subdomains api06, api08, apis, chat, beacon; c2iznja[.]com (active 2025–2026 cluster) and its subdomains api80, newdma, live-hk, turbo, base64, cache.
    • IP addresses: 202.144.192[.]23, 202.144.192[.]149, 210.1.226[.]163, 210.1.226[.]238, 210.1.231[.]13, 43.245.198[.]195, 43.245.198[.]238.
  • Search for sample hash matches on VirusTotal or other sandboxing platforms, paying attention to artifacts with inconsistent build metadata (for example, PE headers indicating compilation on Windows Server 2003 / Visual Studio 2005 despite much more recent submission dates), which may indicate an isolated development environment or deliberate metadata manipulation.
  • Monitor spikes in scanning against port 161/UDP (SNMP) originating from outside the network, as a possible reconnaissance phase preceding the exploitation of edge routers.
  • Where feasible, use TLS certificate fingerprint pivoting (for example, via Censys or Shodan) to link C2 infrastructure even when the associated domains have rotated.

Wrapping up …

BambooToken is a reminder of a trend that has been consolidating among sophisticated threat actors: weaponizing legitimate, lightly monitored protocols to evade traditional perimeter defenses. Just as abuse of DNS-over-HTTPS, cloud services, code repositories, messaging platforms, and even blockchain for C2 purposes has been seen in the past, MQTT represents the latest variant of this strategy, particularly attractive because its traffic is rarely subjected to deep inspection outside declared IoT/OT contexts.

Several elements of this case deserve highlighting: a campaign that remained undocumented for more than three years, the use of DLL side-loading on legitimate, signed software rather than exploiting zero-day vulnerabilities, and a deployment pattern that — according to the researchers’ hypothesis, not confirmed — would begin by testing techniques on lower-profile environments and victims before escalating toward higher-value or strategic targets. For security teams, the practical lesson is clear: network visibility must extend beyond HTTP(S), DNS, and SMTP to incorporate “invisible” protocols like MQTT, especially in organizations with any adjacent IoT, OT, or remotely managed network device surface.

References

Black Lotus Labs. (2026, September 15). The banana stand: brokering and managing infections across Asia using MQTT. Lumen Technologies. https://www.lumen.com/blog/en-us/the-banana-stand-brokering-and-managing-infections-across-asia-using-mqtt

Lakshmanan, R. (2026, September 15). BambooToken malware uses MQTT to control Windows and Linux systems. The Hacker News. https://thehackernews.com/2026/09/bambootoken-malware-uses-mqtt-to.html

Toulas, B. (2026, September 15). BambooToken malware controls Windows and Linux systems via MQTT. BleepingComputer. https://www.bleepingcomputer.com/news/security/bambootoken-malware-controls-windows-and-linux-systems-via-mqtt/