A previously undocumented malware framework named BambooToken is using the MQTT messaging protocol to control compromised Windows and Linux systems. Researchers have identified infections across several industries, including finance, legal services, hospitality and software development.
The campaign has operated since at least 2023. However, its operators began adding MQTT-based command-and-control capabilities to variants developed between 2024 and 2025.
BambooToken Uses an IoT Messaging Protocol
Message Queuing Telemetry Transport, commonly known as MQTT, is a lightweight messaging protocol. Developers primarily use it to exchange information between Internet of Things devices.
MQTT communications rely on a central broker instead of direct connections between individual systems. Devices publish messages to channels called topics, while other devices subscribe to those topics.
BambooToken malware applies the same structure to malicious communications. Each infected computer subscribes to topics associated with a unique identifier.
The attacker publishes commands to those topics through the MQTT broker. Meanwhile, the infected system sends its status and technical information back through the same infrastructure.
MQTT Helps Attackers Hide Their Infrastructure
Using MQTT gives the operators several advantages. Most importantly, infected computers do not need to connect directly to an attacker-controlled server.
Instead, the MQTT broker relays instructions and responses. This separation makes it harder for defenders to identify the operator’s original infrastructure.
The protocol also supports asynchronous communication. Therefore, the malware can continue operating even when temporary network problems interrupt the connection.
MQTT is not new, but malware developers use it less frequently than traditional web protocols. Researchers previously documented an unrelated backdoor called MQsTTang using a similar technique in 2023.
Malware Hides Behind Legitimate Software
Black Lotus Labs, the threat research division of Lumen, investigated the BambooToken campaign.
Researchers found that the attackers deployed the malware through DLL side-loading. One infection chain abused digitally signed software associated with Tendyron OnKey USB tokens.
Another version impersonated the Kingsoft Office productivity suite. These techniques allow the malware to appear connected to legitimate applications and may help it avoid immediate detection.
Researchers also recovered a BambooToken plugin that checks which antivirus products are installed on a compromised computer. The malware then sends the results to its command-and-control infrastructure.
This information could help attackers understand a target’s defences and adjust their activity accordingly.
Code Points to Additional Surveillance Tools
Black Lotus Labs discovered references to several surveillance functions inside inactive sections of the malware’s code.
The strings pointed to possible capabilities for recording keystrokes, stealing clipboard contents and capturing audio. Other references mentioned webcam access and screenshot collection.
However, researchers found these references in dead code. Therefore, they could not confirm whether the operators had developed or deployed the associated modules.
The functions may represent abandoned features, planned capabilities or tools that investigators have not yet recovered. Consequently, their presence does not prove that BambooToken used them during actual attacks.
Linux Variant Supports Remote Commands
The researchers also uncovered BambooToken version 2.1 for Linux. They observed this version in December 2025, making it the newest sample connected to the campaign.
Like the Windows malware, the Linux variant uses MQTT for command-and-control communications. It collects extensive information about the infected system and sends the data to the operators.
The malware can also open a command shell. In addition, attackers can upload, download and delete files on the compromised machine.
However, Black Lotus Labs noted that the Linux sample appeared to remain under development. Its operators may therefore continue expanding its capabilities.
Enterprise Victims Span Several Industries
Lumen’s telemetry identified around a dozen compromised organisations. Most of the victims were located in Asia and South America.
Affected entities included hotels, biomedical companies, law firms and a financial organisation. Researchers also found a cryptocurrency website in Lithuania among the victims.
Backend systems supporting mobile applications represented the most frequently compromised servers. Access to these environments could expose application data and provide attackers with valuable infrastructure.
The operators also compromised a GitLab server in Hong Kong. Such access could create an opportunity for supply-chain attacks if hackers modify code or development resources distributed to other systems.
Researchers suspect that some activity may have targeted Chinese users living overseas. Those individuals may have used the SpeedCN VPN service to access services inside mainland China.
Researchers Have Not Identified the Operators
Black Lotus Labs could not link the campaign conclusively to a known hacking group or government.
However, the targeting patterns appear consistent with operations aligned with Chinese interests. This observation remains an assessment rather than confirmed attribution.
Lumen has shared indicators of compromise to help security teams detect and block related activity.
Organisations should review unusual MQTT traffic, especially when servers do not require the protocol for legitimate operations. Defenders should also investigate unexpected connections to external MQTT brokers.
Monitoring DLL side-loading activity and unusual processes launched by trusted applications may help identify infections. Additionally, security teams should protect development platforms because compromised repositories can support wider supply-chain attacks.
BambooToken malware shows how attackers can repurpose a legitimate IoT protocol for stealthy remote control. Its support for both Windows and Linux also gives its operators access to a broad range of enterprise environments.
0 responses to “BambooToken Malware Controls Windows and Linux Systems via MQTT”