MQTT-Based BambooToken Malware Targets Windows and Linux Systems

Black Lotus Labs, the threat research arm of Lumen Technologies, has published details of a previously undocumented malware family called BambooToken that uses the MQTT messaging protocol to command both Windows and Linux systems. The researchers say they discovered the malware on VirusTotal in early 2026, with evidence pointing to a skilled threat actor that has managed to stay undetected until now. Activity linked to the malware has been detected as recently as July 2026, and the earliest known activity dates back at least to February 2023. Targets have been identified across Asia and South America, and the initial access method used to deliver BambooToken remains undetermined, according to the report shared with The Hacker News.

MQTT, short for Message Queueing Telemetry Transport, is a lightweight publish-subscribe network protocol often used by Internet of Things devices to exchange small messages. Its use as a remote command-and-control (C2) channel is not new. In January 2023, the Chinese nation-state hacking group Mustang Panda was observed using a backdoor called MQsTTang that used the IoT messaging protocol to fetch and execute commands on compromised hosts. Other documented examples include the Android malware Tizi, which can harvest sensitive data from messaging and social media apps and use HTTPS or MQTT for C2, the malware loader WailingCrab (also known as WikiLoader), distributed via delivery and shipping themed email messages and attributed to the cybercrime group Bamboo Spider, and the operational technology malware IOCONTROL (also known as OrpaCrab), which has targeted IoT and SCADA systems in Israel and the U.S.

A key element of the campaign is its use of Tendyron OnKey software to sideload agents into targeted machines. Tendyron OnKey is a second-generation Public Key Infrastructure (PKI) USB security token and authentication device designed to protect online banking and financial transactions. The vendor claims to have 190 million tokens in circulation, and its website lists customers in China's financial and government sectors, among other verticals. Black Lotus Labs said neither Tendyron's code-signing certificate nor its build environment has been compromised in connection with the activity. Instead, the researchers suspect the operators are relying on a binary that is vulnerable to DLL sideloading, a technique where a program is tricked into loading a malicious helper file from the wrong location. Later versions of BambooToken sideload a rogue version of a DLL named OnKeyToken_KEB.dll used by the Tendyron OnKeySrv program. Most BambooToken samples have been uploaded to VirusTotal from Chinese IP address space, which the researchers say indicates a data collection campaign targeting users within China and neighboring countries.

Early iterations of the BambooToken agent work by extracting the C2 server from a .DAT file, or falling back to a hard-coded server if the file is not found. The malware then gathers system details and sends them to the C2 server chat5188[.]tk. In response, the server issues commands to load a plugin, stop all plugins, terminate the malware, and disconnect from the C2 server. Subsequent versions of the malware sideload the rogue OnKeyToken_KEB.dll to enumerate the host and enter a command loop that uses MQTT for C2. As of December 2025, BambooToken has expanded in scope to also target Linux hosts while still relying on MQTT. Ryan English, an information security engineer at Lumen Technologies Black Lotus Labs, told The Hacker News that the first version of BambooToken was initiated via a PowerShell script, using the Windows automation tool to allocate memory and run the malicious file. English said the team assesses that sideloading would likely trigger fewer endpoint detection and response (EDR) alerts, so as the campaign evolved, the threat actor's tactics, techniques, and procedures changed.

BambooToken is equipped to collect extensive host information and deliver an antivirus plugin for Windows. That plugin uses the Windows Management Instrumentation (WMI) framework to gather details about installed antivirus products on the machine and exfiltrate them to a second C2 server, api80.c2iznja[.]com. The domains used Cloudflare as a proxy for their infrastructure. One domain associated with the 2025 campaign recently entered the top 500,000 domains on Cloudflare Radar, a public service that tracks domain popularity and internet traffic. The older domain ranked in the top 1 million at the peak of operations in 2024, indicating widespread infection across campaigns for this activity cluster.

Black Lotus Labs also identified IP addresses geolocated to Singapore, Cambodia, and Vietnam communicating with one of the active C2 nodes. These IP addresses correspond to MikroTik and DrayTek routers. A dozen compromised entities have been detected in Asia and South America. The vast majority of the compromised servers are associated with mobile applications, as well as a GitLab server in Hong Kong and a Vietnamese company developing a portable lifestyle management device. Other targets include a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania, and a Malaysian finance organization.

It is unknown at this stage who is behind the activity. However, Lumen said the use of DLL sideloading, coupled with a SoftEther VPN connection originating from a Virtual Private Server (VPS) to one of the C2 nodes, suggests a China nexus. Another point Lumen raises is that both MQsTTang and BambooToken emerged around the same time in early 2023. While there is no evidence of overlap between the two threat activity clusters, Lumen said it is possible the threat actor could have taken a leaf out of the Mustang Panda playbook to update its own malware to support MQTT in upcoming versions.

Lumen concluded that using MQTT to control numerous clients from a central point, combined with routing via Cloudflare, enables large-scale operation through an unconventional communication method. The researchers added that they believe this campaign's targeting supports extensive data collection: mobile apps and smartwatches connected to cellular networks could enable pattern-of-life analysis, targeting financial organizations might expose transaction data, and attacking hospitality systems could reveal travel history and plans. For organizations running mixed Windows and Linux fleets, AEU-I offers security-first IT and infrastructure consulting to help review how trusted software is loaded and how unusual command channels are monitored.