BambooToken Uses MQTT to Control Compromised Windows and Linux Systems

A previously undocumented malware framework named BambooToken is using the Message Queuing Telemetry Transport protocol to control compromised Windows and Linux machines.

Lumen Technologies’ Black Lotus Labs found the malware on VirusTotal in early 2026. The activity has since been associated with compromised infrastructure serving mobile applications, financial and legal organizations, software developers, hotels, biomedical companies, and cryptocurrency services.

The available timelines differ slightly. BleepingComputer reports that BambooToken has operated since at least 2023 and describes a Linux version observed in December 2025. The Hacker News says the campaign began no later than February 2023, with related activity detected as recently as July 2026.

No threat actor has been conclusively identified. Black Lotus Labs considers the targeting compatible with a China-aligned intelligence operation, but that assessment remains unconfirmed.

MQTT Separates Infected Hosts From Operator Infrastructure

BambooToken’s defining feature is its use of MQTT, a lightweight publish-subscribe protocol commonly deployed in Internet of Things environments.

Instead of every infected machine maintaining a conventional direct session with an attacker-operated command server, BambooToken communicates through an MQTT broker. Each implant subscribes to topics associated with a unique host identifier. Operators publish instructions to those topics, while compromised systems send status messages and collected information through the broker.

This arrangement gives the operators several advantages. Commands and responses can be exchanged asynchronously, allowing an implant to resume communications after a temporary network interruption. A single broker can also coordinate many compromised clients without exposing a separate direct connection for each one.

The architecture complicates defensive analysis because discovering an MQTT endpoint does not necessarily reveal the operator’s underlying infrastructure. The campaign also placed associated domains behind Cloudflare, further obscuring their origin.

Early BambooToken agents obtained their command-and-control address from a .DAT file and used a hard-coded fallback when that file was unavailable. After connecting, the implant collected host information and transmitted it to chat5188[.]tk.

Operators could then order the malware to load a plugin, stop running plugins, terminate itself, or disconnect from the command service. Another domain, api80.c2iznja[.]com, was used for antivirus-related collection and exfiltration.

Black Lotus Labs observed substantial traffic around the infrastructure. A domain connected to the 2025 campaign entered Cloudflare Radar’s top 500,000 domains, while an older domain reached the top one million during peak activity in 2024. Researchers interpreted that visibility as evidence that the campaign may have infected systems at significant scale.

Operators Shifted From PowerShell to DLL Sideloading

The earliest identified BambooToken version used a PowerShell stager that allocated memory and executed the malicious payload. The campaign later moved toward DLL sideloading, reportedly because the operators believed it would trigger fewer endpoint detection and response alerts.

Later Windows variants use the legitimate Tendyron OnKeySrv program to load a malicious library named OnKeyToken_KEB.dll. Once loaded, the DLL inventories the host and enters the MQTT command loop.

Tendyron OnKey is a Public Key Infrastructure USB-token and authentication product used for workstation access, banking, and financial transactions. Its maker claims that 190 million tokens are in circulation, including deployments among financial and government customers in China.

There is no evidence that Tendyron’s code-signing certificate or build environment was breached. The documented technique instead appears to abuse a legitimate binary capable of loading a malicious DLL from an attacker-controlled location.

BambooToken has also reportedly been distributed by impersonating the Kingsoft Office productivity suite. However, the campaign’s original access vector remains unknown. Investigators have not established how attackers first reach every affected environment before executing the stager or arranging the sideloading chain.

The exact vulnerable or affected versions of Tendyron OnKey software have not been disclosed. No CVE identifier, vendor patch, CVSS score, or formal severity rating has been reported, and the activity is not described as a CISA Known Exploited Vulnerabilities catalog entry.

Windows Plugins and Linux 2.1 Enable Broad Collection

BambooToken has a modular design, allowing operators to extend an infection by loading additional components. A recovered Windows plugin used Windows Management Instrumentation to enumerate installed antivirus products and return the results to the command infrastructure.

Researchers also found strings referring to keylogging, clipboard theft, microphone recording, webcam access, and screenshot capture. Those references appeared in an inactive section of the binary’s .rdata data, however.

Consequently, there is no confirmation that BambooToken operators deployed those surveillance functions. They could represent abandoned features, unfinished development, or modules that were not present in the samples available for examination.

A Linux build identified as BambooToken version 2.1 was observed in December 2025. It retained the MQTT-based control channel while collecting extensive information about the infected host.

The Linux implant can open a command shell and supports file uploads, downloads, and deletion. These functions give an operator direct access to data and create opportunities to install additional tools or remove evidence. Black Lotus Labs assessed that the recovered Linux sample still appeared to be under development.

Cross-platform support broadens the campaign’s reach. Attackers can target employee workstations while also compromising backend servers, development systems, and application infrastructure running Linux.

Compromised Enterprises Span Asia and South America

Lumen telemetry identified approximately a dozen compromised enterprise entities, primarily in Asia and South America. They included mobile-application backend systems, a hotel in Vietnam, a Vietnamese developer of a portable lifestyle-management device, a biomedical company in Argentina, and a Chilean legal firm.

Other affected infrastructure included a Malaysian financial organization, a cryptocurrency website in Lithuania, and a GitLab server in Hong Kong. Access to a development platform such as GitLab could provide a route toward source code, credentials, build processes, or downstream software users, although no resulting supply-chain attack has been confirmed.

Researchers also identified IP addresses in Singapore, Cambodia, and Vietnam communicating with an active command node. Those addresses corresponded to MikroTik and DrayTek routers, indicating that the observed infrastructure was not limited to conventional Windows and Linux endpoints.

Most BambooToken samples uploaded to VirusTotal came from Chinese IP address space. That pattern is consistent with a data-collection operation focused on users in China and neighboring countries, although sample-upload geography alone cannot establish the operator’s identity.

Some activity may also have involved overseas Chinese users accessing mainland services through the SpeedCN VPN service.

The selection of victims suggests intelligence-gathering value. Mobile applications and connected devices can expose behavioral patterns, while hotel systems may contain travel records. Legal and financial environments can hold confidential communications, transaction information, and identity data.

China-Aligned Attribution Remains an Assessment

Black Lotus Labs has not tied BambooToken to a named group or established intrusion cluster. Its assessment is based on the campaign’s targeting and several technical or infrastructure-related indicators.

These include the concentration of samples in Chinese address space, the use of DLL sideloading, and a SoftEther VPN connection from a virtual private server to one of the command nodes.

BambooToken also appeared around the same period as MQsTTang, an MQTT-based backdoor associated with Mustang Panda. Researchers found no operational overlap between the two clusters. One possibility is that BambooToken’s developers adopted MQTT after observing its use elsewhere, but there is no evidence demonstrating that relationship.

MQTT remains relatively uncommon in malware compared with HTTP, HTTPS, or raw TCP channels. Its legitimate use in IoT and messaging environments can nevertheless help malicious traffic blend into networks where the protocol is expected.

Defenders Should Hunt for Sideloading and Unexpected MQTT

Organizations running Tendyron OnKey software should examine OnKeySrv installations for unsigned, recently introduced, or unexpected DLLs, particularly files named OnKeyToken_KEB.dll. Security teams should also review module-loading telemetry, unusual child processes, and execution from user-writable directories.

Network monitoring should identify Windows or Linux servers making MQTT connections when they have no operational reason to use the protocol. Investigators should inspect unusual broker destinations, topic subscriptions, publishing activity, and repeated reconnect patterns.

Additional behaviors worth investigating include:

• Connections involving chat5188[.]tk or api80.c2iznja[.]com
• PowerShell processes that allocate memory before executing embedded or retrieved code
• WMI queries enumerating installed antivirus products
• Unexpected shells or file transfers on Linux servers
• SoftEther VPN traffic between VPS infrastructure and suspected command nodes
• Unexplained communications from MikroTik or DrayTek routers
• Cloudflare-proxied traffic correlated with other BambooToken indicators

Cloudflare traffic alone is not a reliable indicator because the service supports large volumes of legitimate infrastructure. MQTT activity should likewise be evaluated against each system’s normal role.

With no disclosed patch or confirmed affected OnKey version, defenders currently need to rely on behavioral detection, DLL integrity checks, network telemetry, and endpoint investigation. Systems supporting development, finance, hospitality, mobile applications, and connected devices warrant particular scrutiny.