BambooToken MQTT malware adopts new C2 channel

BambooToken MQTT malware, first identified in 2023, has upgraded its command-and-control (C2) channel to the Message Queuing Telemetry Transport (MQTT) protocol. Researchers at ESET noted the shift in variants released between 2024 and 2025, and Black Lotus Labs confirmed active deployments as of December 2025. By subscribing to unique topics on a public or compromised broker, infected hosts receive commands without ever contacting the attacker’s IP directly, dramatically increasing stealth and resilience. The use of MQTT, an IoT-focused protocol, allows the malware to blend with legitimate telemetry traffic.

  • MQTT is broker-centric, eliminating direct point-to-point sockets.
  • The malware creates a persistent subscription tied to a hard-coded identifier; operators publish commands to that topic.
  • Status updates and system telemetry flow back through the same broker, hiding in plain sight.

Takeaway: Network defenders should treat unexpected MQTT traffic on enterprise servers as a high-priority alert.

Multi-Platform Payloads and Capabilities

The latest Windows sample enumerates installed antivirus products and reports the list to the broker. A parallel Linux variant (v2.1) can spawn a command shell, upload/download files, and delete data. Both versions embed strings that reference keylogging, clipboard theft, audio capture, webcam snapshots, and screenshot functions. While some of these capabilities reside in dead code, their presence signals intent to expand espionage functions.

  • Windows payload: AV enumeration → potential evasion decisions.
  • Linux payload: file system manipulation → risk to development pipelines.
  • Both include modules for audio/video capture, indicating possible surveillance of remote workers.

Takeaway: Endpoint protection should block unsigned DLL loading and monitor for suspicious USB token drivers.

Distribution Vectors: Signed USB Token and Office Spoofing

Black Lotus Labs traced initial infection chains to two distinct methods:

  1. Side-loading via a digitally signed Tendyron OnKey USB-token utility. The legitimate driver is trusted by Windows, allowing the malicious DLL to load silently.
  2. Impersonation of Kingsoft Office suite. Users who download a fake installer receive the BambooToken payload bundled with a seemingly benign office package.

Both techniques exploit trust relationships—code-signing certificates and brand recognition—to bypass user awareness.

Takeaway: Verify software signatures against vendor-published hashes and enforce application whitelisting on critical workstations.

Target Landscape and Geographic Footprint

Lumen’s telemetry identified roughly a dozen compromised entities, predominantly in Asia and South America. Affected sectors include hospitality, biomedical research, law practices, financial services, and a cryptocurrency exchange operating out of Lithuania. The most common victims were backend servers for mobile applications, suggesting attackers aim to harvest API keys, user data, and potentially inject malicious updates into app distribution pipelines.

Takeaway: Organizations hosting mobile-app backends should audit server-side dependencies and isolate them from public networks.

Supply-Chain Implications

One compromised asset was a GitLab instance in Hong Kong. By gaining repository write access, threat actors could embed malicious code into CI/CD pipelines, creating a foothold for downstream attacks on software supply chains. Although no direct payloads have been observed yet, the risk aligns with recent trends of attackers leveraging compromised dev-ops platforms.

  • Potential to inject backdoors into future releases of legitimate software.
  • May affect downstream customers, including cryptocurrency wallets that rely on open-source components.

Takeaway: Enforce multi-factor authentication on Git repositories and regularly scan CI pipelines for unauthorized changes.

Attribution and Geopolitical Context

While the report does not assign BambooToken to a known APT group, the targeting pattern—particularly the focus on overseas Chinese users accessing mainland services via the SpeedCN VPN—mirrors tactics used by China-aligned actors. The campaign’s emphasis on financial and crypto-related targets further fuels speculation about state-sponsored intelligence gathering.

Takeaway: Organizations with ties to Chinese markets should assume heightened scrutiny and consider threat-intel feeds that track China-aligned activity.

Detection and Mitigation Strategies

Black Lotus Labs released a set of Indicators of Compromise (IoCs) covering broker addresses, topic identifiers, and file hashes. Defensive steps include:

  • Network level: Block outbound MQTT (TCP 1883/8883) to unknown brokers; monitor for persistent subscriptions.
  • Endpoint level: Deploy behavior-based EDR that flags processes creating MQTT client sockets.
  • Log analysis: Correlate broker connection logs with process creation events on critical servers.
  • Supply-chain hygiene: Regularly audit third-party libraries and enforce signed binaries only.

For organizations tracking cryptocurrency market exposure, note that a compromised exchange could affect market cap rankings if trading volumes are manipulated.

Broader Industry Impact

The use of MQTT for C2 blurs the line between IoT-focused threats and traditional enterprise malware. As more businesses adopt MQTT for telemetry (e.g., smart building sensors, edge computing), the attack surface expands. Security teams must adapt their detection playbooks to include protocol-specific heuristics rather than relying solely on classic port-based rules.

Takeaway: Updating IDS/IPS signatures to recognize anomalous MQTT topics and payloads is now a critical defensive measure.

What to Watch Next

  • Emerging variants: Keep an eye on future releases that may activate dead-code modules for keylogging and audio capture.
  • Broker abuse trends: Watch for reports of compromised public MQTT brokers being repurposed for C2.
  • Regulatory response: Expect advisories from national CERTs, especially in regions where the affected entities operate.

By staying vigilant on MQTT traffic and applying strict code-signing policies, enterprises can reduce the risk posed by BambooToken MQTT malware and similar protocol-abusing families.

For the original report, see the original report.

Explore more on this topic