BambooToken: Malware Controls Windows and Linux Through the IoT Protocol MQTT

Researchers at Lumen's Black Lotus Labs division have detailed a previously unknown malware framework called BambooToken, active since at least 2023. Its distinguishing feature is the use of the MQTT protocol to communicate with the command server. In the 2024–2025 variants, MQTT was used to control infected servers belonging to mobile app, legal and financial services, as well as software developers.

MQTT is a lightweight messaging protocol originally designed for IoT devices. It works not through direct connections but through a central broker and channels called “topics,” which link publishers and subscribers. The approach is not new — in 2023 ESET described an unrelated backdoor called MQsTTang — but it remains rare.

How the Communication Works

An infected machine subscribes to topics tied to a unique identifier, and the operator publishes commands to those topics. The malware, in turn, sends information about the system and its status through the broker. The upside of this scheme for the attacker is obvious: victims never reach out to his infrastructure directly, which improves stealth and resilience. The asynchronous nature of the exchange makes it possible to retain control even during temporary network outages.

The intrusion happened through sideloading: the malicious code was loaded either using the signed software of the Tendyron OnKey USB token or under the guise of the Kingsoft Office suite.

What It Can and Cannot Do Yet

One of the plugins that was found enumerates the installed antivirus products and sends the result to the C2. The code also contains strings pointing to keylogging, clipboard theft, audio recording, camera capture and screenshots. However, all of this was extracted from “dead code,” so the researchers are not prepared to claim that the corresponding modules were actually used rather than left at the development stage.

The most recent sample is the Linux variant of BambooToken version 2.1 (spotted in December 2025). It, too, operates over MQTT, gathers detailed system data, can launch a command shell and allows files to be uploaded, downloaded and deleted. That said, according to Black Lotus Labs, the Linux version still looks unfinished.

Victims and a Probable Attribution

Lumen's telemetry uncovered about a dozen compromised organizations, mostly in Asia and South America: hotels, biomedical companies, law firms, a financial organization and a cryptocurrency site in Lithuania. Most often it was the backend infrastructure of mobile apps that was hit. The compromise of a GitLab server in Hong Kong is mentioned separately — a potential beachhead for supply-chain attacks.

Lumen suggests that part of the activity may have been aimed at Chinese nationals abroad who access mainland services through the SpeedCN VPN. The campaign could not be attributed to a specific group, but the pattern of targets, in the researchers' view, is consistent with pro-Chinese operations. Indicators of compromise have been published for defenders.

Source: Bleeping Computer