BambooToken Malware Uses MQTT to Quietly Control Windows and Linux Systems Across Asia

Lumen's Black Lotus Labs has uncovered an emerging malware family called BambooToken that uses the Message Queuing Telemetry Transport (MQTT) protocol to communicate with infected Windows and Linux systems.

According to the research, technical evidence indicates that the activity dates back to at least February 2023 and continued through July 2026. The campaign has involved stealthy infrastructure, software side-loading and systems connected to mobile applications, software development, hospitality, legal and financial services.

The research is particularly notable because BambooToken uses MQTT, a protocol more commonly associated with IoT and machine-to-machine communications, as part of its command-and-control infrastructure. Lumen says this approach can allow compromised systems to communicate through a broker rather than directly connecting to the attacker's infrastructure.

BambooToken: A malware framework evolving over several years

Black Lotus Labs discovered the latest BambooToken sample after finding an undocumented malware family uploaded to VirusTotal in early 2026.

Lumen's analysis indicates that the underlying framework had already existed for several years. The earliest identified version dates to February 2023, while later variants introduced MQTT communications and eventually expanded to Linux.

The researchers describe BambooToken as an emerging threat cluster because they could not correlate the malware framework with a previously documented activity group.

The campaign's observed targets included backend servers supporting mobile applications, a GitLab server, a software company associated with smartwatches, a hotel, and organisations in legal and financial sectors.

Lumen also observed infrastructure and telemetry associated with systems in Southeast Asia and South America. The research highlights the potential supply chain implications of compromising software development infrastructure and backend services that may have relationships with other systems.

Why MQTT matters

MQTT is a lightweight publish-and-subscribe messaging protocol commonly used for IoT systems.

Instead of requiring every device to communicate directly with another system, MQTT uses a broker to manage messages between publishers and subscribers.

That architecture can provide an attractive mechanism for malware operators.

In BambooToken's case, the compromised system can subscribe to specific MQTT topics and receive commands through the broker. Lumen notes that this architecture can hide other parts of the attacker's infrastructure because the infected system does not necessarily communicate directly with the ultimate command-and-control server. MQTT also supports asynchronous communication.

Lumen says the technique is unusual in malware. Its research identified only three previous campaigns using MQTT in a similar context: IOCONTROL, Korplug or PlugX, and WailingCrab.

From HTTP-based control to MQTT

The first identified BambooToken version relied on conventional C2 communications.

The framework appeared in February 2023 and collected information about the infected computer, including architecture, CPU information, memory, public IP address, MAC address and file information. The C2 could issue commands including loading plugins, stopping plugins, terminating the malware and disconnecting from the C2.

Between 2024 and 2025, the malware evolved.

Version 2.0 introduced MQTT in place of the HTTP-based communication approach identified in the earlier version. On Windows, the campaign used a technique known as hijack flow execution, in which a legitimate program's execution flow is abused to load an attacker-controlled file.

Lumen found evidence that BambooToken was sideloaded through Tendyron's OnKey software. The OnKey program is associated with hardware-based USB tokens used for authentication and cryptographic services.

Importantly, Lumen does not assess that Tendyron's code-signing certificate was compromised. Instead, the researchers believe the legitimate executable was vulnerable to DLL side-loading.

A separate variant also masqueraded as software associated with Zhuhai Kingsoft Office Software. Lumen similarly says it does not assess that the company's code-signing certificate was obtained by the attackers.

BambooToken's Windows communication model

After execution, the malware enumerated information from the Windows host using Windows Management Instrumentation, or WMI.

The collected information included operating system details, computer product information, product keys, serial numbers and software licensing information.

The malware then subscribed to multiple MQTT topics. Some topics were global, while others were associated with a GUID embedded within the malware.

This GUID-based structure provided a mechanism for communicating with specific infected systems while maintaining a broader broadcast channel.

Lumen assesses that the malware uses the open-source Mosquitto MQTT library developed by Eclipse.

Linux expands BambooToken's reach

The campaign was not limited to Windows.

Black Lotus Labs identified a Linux sample first observed in December 2025. Based on technical similarities, the researchers assess with high confidence that the Windows and Linux toolsets belong to the same activity cluster.

The Linux version used five MQTT topics, including a global broadcast topic and four topics associated with the malware's GUID.

The sample periodically sent status information to the C2 infrastructure and waited for instructions.

Three command handlers identified by researchers were particularly significant:

• SHELL: creates a command shell.

• FILEEX: supports file upload, download and deletion, along with execution control.

• ONLINE: gathers system information and sends a heartbeat to the C2 infrastructure.

The Linux variant could collect information including system details, BIOS information, serial numbers, MAC address, CPU, memory, process and thread identifiers, version and architecture.

The antivirus-checking plugin

BambooToken's newer variants contain references to plugin functionality.

Lumen identified one likely plugin that uses WMI to enumerate antivirus products installed on a Windows system.

The plugin periodically collects antivirus information and sends the results to the C2 infrastructure. The researchers suspect this capability may have been intended to help the attackers understand the defensive software present on compromised systems, although Lumen states this as an assessment rather than a confirmed operational purpose.

The research also found strings in dead code that appear to reference additional functionality.

These included names suggesting possible keylogging, clipboard access, audio recording and image or screen capture. However, Lumen did not identify corresponding execution paths for these functions in the analyzed sample.

This distinction is important. The presence of strings in dead code can provide clues about development history or planned functionality, but it does not establish that those capabilities were actively deployed.

What dead code revealed about the malware's development

One of the more unusual parts of the investigation involved the malware's compiled artifacts.

Researchers found similar XOR keys and RichPE header information across samples from different campaign periods. Lumen says this suggests that multiple samples may have been compiled from a common codebase and development environment.

Some samples also contained metadata suggesting compilation with Windows Server 2003 and Visual Studio 2005.

Lumen says these characteristics may have been deliberately manipulated or may reflect an isolated development environment. The researchers also observed variation in compilation timestamps rather than identical timestamps across samples, which they interpreted as another possible indication of sanitisation.

The investigation also found dead-code strings that appeared to reference capabilities such as KEY_RECOURD, potentially associated with keylogging, and COM_clipboard, potentially associated with clipboard access.

Lumen presents these as clues rather than proof that those capabilities were operational in the analyzed sample.

Infrastructure and Cloudflare proxying

Lumen identified infrastructure overlap between older and newer campaign domains.

The research describes IP addresses that were associated with both the older chat5188[.]tk infrastructure and newer c2iznja[.]com infrastructure.

The researchers believe this overlap may indicate that the infrastructure was used to maintain access to previously infected systems while transitioning them toward newer payloads.

The campaign also used Cloudflare as a proxy for some infrastructure.

According to Lumen, one C2 domain associated with the 2025 campaign appeared in Cloudflare Radar's top 500,000 domains, while an older domain reached the top one million during its peak in 2024.

These rankings should not be interpreted as direct measurements of the number of infected systems. They indicate that the domains had sufficient observed traffic or popularity to appear within Cloudflare Radar's rankings.

Who was targeted?

Lumen's telemetry revealed two broad categories of affected systems.

The first involved individual or small-network infrastructure. Researchers observed activity involving routers, including MikroTik and DrayTek devices, in Singapore, Cambodia and Vietnam.

The second category involved enterprise systems.

The research identified compromised infrastructure associated with mobile applications, software development, hospitality, biomedical services, legal services, cryptocurrency-related websites and financial organisations.

Among the systems identified by Lumen were a GitLab server in Hong Kong, a software development company in Vietnam, a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania and a Malaysian finance organisation.

Lumen also observed activity involving a VPS associated with SoftEther and traced related connections to infrastructure in China. However, the researchers said they could not determine the entity behind the China Mobile IP address involved in that observation.

Why the supply chain angle matters

The BambooToken campaign illustrates how an attacker does not necessarily need to compromise a large organisation directly to create broader security consequences.

The research identified compromised backend systems, software development infrastructure and a GitLab server.

A compromised development or backend environment can potentially provide access to software, credentials, data or connected systems. The exact impact depends on the permissions, connectivity and security controls surrounding the compromised system.

For enterprises, this highlights the importance of understanding not only internal infrastructure but also software dependencies, development environments and externally connected systems.

The announcement highlights a broader industry shift toward attacks that exploit trust relationships across interconnected technology environments.

What security teams can do

Black Lotus Labs recommends that organisations take several defensive measures based on the observed activity.

Map software supply chains and dependencies

Organisations should maintain visibility into software dependencies and establish appropriate CI/CD security controls. This can make it easier to identify unexpected components and investigate suspicious activity within development environments.

Patch and harden routers

Lumen recommends routinely patching routers and configuring them so they do not respond to unnecessary external SNMP requests. It also recommends replacing default community strings and passwords.

Monitor endpoints

A well-tuned Endpoint Detection and Response platform can help identify suspicious activity across network assets. Lumen also recommends centralised monitoring for indicators of lateral movement.

Monitor unusual protocols

Firewall policies should be able to identify abnormal protocols leaving internal networks. Lumen specifically recommends looking for unexpected MQTT traffic crossing network boundaries.

Watch large outbound transfers

Security teams should monitor unusually large data transfers leaving their environments, including transfers to destinations that appear geographically close.

Track threat intelligence indicators

Lumen has added indicators associated with the campaign to its threat intelligence feed and encourages organisations to monitor the published indicators and related infrastructure.

The bigger security lesson

BambooToken demonstrates why security teams should not limit network monitoring to traditional web protocols.

MQTT is legitimate technology with widespread uses in IoT and machine-to-machine communication. Its presence in a network is therefore not automatically malicious.

The security challenge is identifying when a legitimate protocol is being used in an unexpected context.

For defenders, that means combining protocol visibility with endpoint telemetry, DNS monitoring, application inventories, network segmentation and behavioural detection.

The campaign also demonstrates the importance of software supply chain visibility. A legitimate, signed application can potentially become part of an attack chain without the vendor's signing certificate itself being compromised. In BambooToken's case, Lumen attributes the Windows execution technique to DLL side-loading rather than certificate theft.

The research does not establish that every organisation using the affected software is compromised, nor does it establish that all capabilities suggested by dead-code strings were deployed.

What it does provide is a detailed view into an evolving malware framework that combines side-loading, MQTT communications, host enumeration and modular functionality across Windows and Linux.

For enterprise defenders, the practical takeaway is straightforward: monitor legitimate protocols for abnormal use, maintain visibility into software dependencies and development infrastructure, and investigate unexpected MQTT communication from systems that would not normally require it.

Additional details were not disclosed in the announcement beyond the indicators and technical analysis published by Black Lotus Labs.