BambooToken moves its Windows and Linux command channel onto MQTT brokers
Black Lotus Labs counted about a dozen compromised enterprises, mostly in Asia and South America, on a framework that has been publishing operator commands to infected hosts through IoT message brokers since 2024.
The Watch · Security desk
What happened
- Lumen's Black Lotus Labs documented BambooToken, a framework unknown until now, active since at least 2023 and using the MQTT messaging protocol to control Windows and Linux hosts.
- Initial access came from side-loading through digitally signed Tendyron OnKey USB-token software, or from packages impersonating the Kingsoft Office productivity suite.
- Lumen's telemetry identified roughly a dozen compromised enterprise entities, mostly in Asia and South America, with mobile application backend servers the most common victim type.
- The newest sample linked to the campaign is a Linux build numbered 2.1, seen in December 2025, which also uses MQTT and gives operators a shell plus file upload, download and delete.
Why it matters
- What's now possible capability An operator holds control without the victim ever touching attacker-owned infrastructure, so IP and domain blocking aims at a message broker rather than at the party issuing commands.
- Who's exposed exposure The concentration in mobile app backends puts each app publisher's users downstream of a server an operator can already run commands on.
- What it limits constraint Without a named cluster, defenders get indicators and behaviour to hunt on and no existing actor profile to pivot from when they find a hit.
- What it sets up precedent Two documented families now push commands through MQTT brokers, so egress policy that treats IoT protocols as background noise has been abused more than once.
Next story · Security · 3d ago
npm Trusted Publishing accepted a freed GitHub repo name as proof of who may publishConfirmed3 publishers
Each infected host subscribes to MQTT topics keyed to a unique identifier, and the operator publishes the commands to be run into those topics [12]. The host publishes status and system information back through the same broker and takes its instructions from the topics it subscribes to [13]. MQTT is a lightweight protocol built for IoT devices, and it relays messages through a central broker instead of a direct channel between the two ends [10]. The victim therefore never connects to attacker-owned infrastructure, and Black Lotus Labs credits that indirection for the malware's evasion and resilience; the traffic is asynchronous, so a command waits in the topic through a temporary network outage [3].
BambooToken is not the first MQTT backdoor. ESET published on an unrelated MQTT backdoor called MQsTTang in 2023 [11], before the BambooToken variants that moved to MQTT were built in 2024 and 2025 [2][17]. A server running a mobile application backend has no obvious reason to speak an IoT telemetry protocol outbound [10][15]. The case for the protocol as a gap rests on the broker sitting in the middle; Lumen did not measure how widely enterprises inspect or block MQTT [19].
The victim list runs to hotels, biomedical firms, law firms, a financial organization and a cryptocurrency website in Lithuania [8]. Measured against a run from 2023 to the December 2025 Linux sample [1][6], a dozen entities is roughly five a year in the visibility Lumen has [23]. Black Lotus Labs also found a compromised GitLab server in Hong Kong, and calls it a potential foothold for supply-chain attacks [16].
The capability inventory is thinner than the strings suggest. The one plugin the researchers recovered enumerates antivirus products on the host and returns the results to the C2 [5]. Keylogging, clipboard theft, audio recording, webcam capture and screenshot capture appear only as strings in dead code, and the researchers say they cannot tell whether those modules existed and were used or were still being written [14]. Of the newest build, Black Lotus Labs said "the Linux sample still appeared to be under development" [7].
Lumen hypothesizes that some of the activity targeted overseas Chinese users reaching mainland services through the SpeedCN VPN service [21]. The researchers could not attribute the activity to a specific threat actor or a known cluster, and say the targeting patterns are consistent with China-aligned operations [9]. Indicators of compromise for the campaign are published [22].
What to watch
- Whether Lumen or another vendor ties BambooToken to a named activity cluster.
- Whether the Linux 2.1 build turns up as a finished tool carrying the modules the dead-code strings name.
- Whether the compromised Hong Kong GitLab server produces a downstream supply-chain incident in a customer of that repository.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence66
- Adoption18
- Hype gap+20
- Incentives
- Not scored
- Confidence64
Perspective Coverage
3 publishers- Builder
- Builder 27%
- Operator
- Operator 62%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A previously unknown malware framework called BambooToken, active since at least 2023, is now using the MQTT protocol to communicate with Windows and Linux systems.
- [2]
BambooToken adopted MQTT for command-and-control in variants developed between 2024 and 2025, compromising servers used by mobile apps, legal and financial services, and software development.
- [3]
Infected systems do not connect directly to the attacker's infrastructure, which increases evasion and resilience; communications can be asynchronous, ensuring operational continuity during temporary network disruptions.
- [4]
A report from Lumen's research arm, Black Lotus Labs, says BambooToken infected systems by side-loading via digitally signed Tendyron OnKey USB-token software or by impersonating the Kingsoft Office productivity suite.
- [5]
The researchers recovered a BambooToken plugin that enumerates antivirus products on infected hosts and returns the results to the C2.
- [6]
A Linux variant, BambooToken version 2.1, was the most recent linked to the campaign and was observed in December 2025; it uses MQTT, collects extensive system information, can spawn a command shell, and allows operators to upload, download and delete files.
- [7]
"the Linux sample still appeared to be under development"
- [8]
Lumen's telemetry identified approximately a dozen compromised enterprise entities, mostly in Asia and South America, including hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency website in Lithuania.
- [9]
The researchers could not attribute BambooToken activity to a specific threat actor or a known activity cluster, but note the targeting patterns are consistent with China-aligned operations.
- [10]
MQTT is a lightweight messaging protocol primarily designed for IoT devices; it relies on a central broker and channels called topics to relay messages from publishers to subscribers, rather than using direct communication channels.
- [11]
MQTT use for malware communication is not novel but is an uncommon approach; researchers at ESET documented an unrelated backdoor called MQsTTang in 2023.
- [12]
In BambooToken infections, the infected machine subscribes to topics associated with a unique identifier, and the attacker publishes to those topics the commands to be executed on infected hosts.
- [13]
The malware publishes status and system information through the broker and receives operator instructions through subscribed topics.
- [14]
Strings pointing to keylogging, clipboard theft, audio recording, webcam capturing and screenshot capturing came from dead code, so the researchers cannot confidently determine whether the referenced modules existed and were used in attacks or were still under development.
- [15]
The most compromised servers were associated with the backend infrastructure of mobile applications.
- [16]
The threat actor also compromised a GitLab server in Hong Kong, creating a potential foothold for supply-chain attacks.
- [17]
Public documentation of MQTT-based command-and-control predates BambooToken's adoption of the protocol: ESET's MQsTTang report is from 2023, and the BambooToken MQTT variants were developed in 2024 and 2025.
- [18]
The BambooToken campaign spans at least about two years, from activity dated to 2023 through the Linux sample observed in December 2025.
- [19]
The Black Lotus Labs findings as reported base the evasion claim on the broker indirection and include no measurement of how widely enterprises inspect or block MQTT traffic.
- [20]
MQTT-based command-and-control has now been documented in at least two malware families: MQsTTang in 2023 and BambooToken.
- [21]
Lumen hypothesizes that some of the activity may have targeted overseas Chinese users accessing mainland services through the SpeedCN VPN service.
- [22]
Lumen has shared indicators of compromise associated with this activity to help defenders detect and block the attacks.
- [23]
About a dozen compromised entities across a run from 2023 to December 2025 is roughly five new victims a year within Lumen's visibility.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comBambooToken malware controls Windows and Linux systems via MQTT
1 article · September 15, 2026
- securityaffairs.comBambooToken: The Malware That Speaks MQTT to Stay Under the Radar
1 article · September 16, 2026
- thehackernews.comBambooToken Malware Uses MQTT to Control Windows and Linux Systems
1 article · September 15, 2026
Topics and entities
Topics
- DLL sideloading and signed-binary abuse
- Malware Command-and-Control Infrastructure
- IoT messaging protocols