Cross-Platform BambooToken Malware Exploits MQTT Protocol for Stealth Control

Cybersecurity researchers have uncovered a sophisticated multi-platform malware family that uses an unconventional communication protocol to silently control infected systems across Windows and Linux environments. The discovery highlights how threat actors are adapting their techniques to evade modern security detection systems.

What Is BambooToken Malware?

The malware, codenamed BambooToken, was discovered by Lumen Black Lotus Labs on VirusTotal in early 2026, though evidence suggests it has been active since at least February 2023. It employs the Message Queueing Telemetry Transport (MQTT) protocol as its command-and-control (C2) communication channel, allowing attackers to remotely control compromised machines with minimal network footprint.

MQTT is a lightweight, publish-subscribe messaging protocol commonly used in IoT devices and low-bandwidth environments. By repurposing this protocol for malicious C2 communications, BambooToken can blend its traffic with legitimate IoT and application messaging, making it exceptionally difficult for network security tools to detect.

DLL Sideloading Through Trusted Security Software

One of the most concerning aspects of BambooToken is its delivery mechanism. The threat actor exploits Tendyron’s OnKey software to sideload malicious agents into targeted machines. Tendyron is a Chinese company that manufactures hardware-based PKI USB security tokens used in high-security environments, including online banking and government workstation authentication. The company claims to have 190 million tokens in circulation.

Rather than compromising Tendyron’s code-signing certificate or build environment, the attackers identified a binary vulnerable to DLL sideloading. By placing a rogue version of a DLL file (OnKeyToken_KEB.dll) in the same directory as the legitimate Tendyron OnKeySrv program, the malware loads malicious code alongside the trusted application, bypassing Endpoint Detection and Response (EDR) systems.

Evolution of Attack Techniques

BambooToken has undergone significant evolution since its first appearance in 2023:

• Early versions used PowerShell scripts as a stager, allocating memory and executing the malicious payload directly
• Later iterations shifted to DLL sideloading, which triggers fewer EDR alerts and provides stealthier persistence
• December 2025 update expanded the malware’s scope to target Linux hosts, making it a truly cross-platform threat
• Recent activity detected as recently as July 2026, indicating the campaign remains active

According to Ryan English, an information security engineer at Lumen Technologies Black Lotus Labs, the evolution from PowerShell-based execution to DLL sideloading was a deliberate tactical shift to reduce detection rates. As the campaign matured, so did the threat actor’s tactics, techniques, and procedures.

How BambooToken Operates

The malware operates through a multi-stage process designed for stealth and persistence:

1. Initial access occurs through DLL sideloading via the vulnerable Tendyron OnKey binary
2. C2 configuration is extracted from a .DAT file, with a hard-coded server as fallback
3. System reconnaissance collects extensive host information and transmits it to the C2 server
4. Plugin loading allows the C2 server to dynamically load additional capabilities, including an antivirus detection plugin that uses Windows Management Instrumentation (WMI) to identify installed security products
5. Data exfiltration sends collected intelligence back to attacker-controlled domains proxied through Cloudflare

The antivirus plugin is particularly noteworthy. By querying WMI for installed antivirus products, the attackers can determine which security tools are running on the target machine and adjust their evasion strategies accordingly.

Global Target Profile

BambooToken has been detected across a diverse range of organizations and industries. At least a dozen compromised entities have been identified across Asia and South America, including:

• Mobile application developers in Asia
• A GitLab server in Hong Kong
• A Vietnamese company developing portable lifestyle management devices
• A hotel in Vietnam, potentially exposing guest travel data
• A biomedical company in Argentina
• A legal firm in Chile
• A cryptocurrency website in Lithuania
• A Malaysian finance organization

Additionally, IP addresses geolocated to Singapore, Cambodia, and Vietnam were found communicating with active C2 nodes. These IP addresses correspond to MikroTik and DrayTek routers, suggesting the threat actor may be compromising network infrastructure to facilitate the campaign.

The MQTT Advantage for Attackers

The choice of MQTT for C2 communications offers several advantages to threat actors:

• Low profile: MQTT traffic is common in IoT environments and rarely flagged by network monitoring tools
• Lightweight: The protocol’s minimal overhead makes it ideal for maintaining persistent connections on compromised systems
• Scalability: The publish-subscribe model allows a single C2 server to manage thousands of infected clients simultaneously
• Cloudflare routing: By routing MQTT traffic through Cloudflare proxies, the attackers add an additional layer of anonymity

One domain associated with the 2025 campaign recently entered the top 500,000 domains on Cloudflare Radar, while an older domain ranked in the top 1 million at the peak of operations in 2024. These rankings indicate widespread and sustained infection across multiple campaign cycles.

Historical Context of MQTT-Based Malware

While BambooToken’s use of MQTT is sophisticated, it is not the first malware to leverage this protocol for C2 communications. Previous campaigns include:

• MQsTTang: A backdoor used by the Chinese nation-state group Mustang Panda, first observed in January 2023, which used MQTT to fetch and execute commands on compromised hosts
• Tizi: An Android malware capable of harvesting sensitive data from messaging and social media apps, using either HTTPS or MQTT for C2
• WailingCrab (aka WikiLoader): A malware loader distributed through shipping-themed phishing emails, attributed to the Bamboo Spider cybercrime group
• IOCONTROL (aka OrpaCrab): An operational technology malware that targeted IoT and SCADA systems in Israel and the United States

Notably, both MQsTTang and BambooToken emerged around the same time in early 2023. While no direct overlap has been confirmed between the two threat clusters, researchers suggest the BambooToken operators may have drawn inspiration from Mustang Panda’s playbook.

Attribution and the China Nexus

The exact identity of the threat actor behind BambooToken remains unknown. However, several indicators point to a China nexus:

• Most BambooToken samples were uploaded to VirusTotal from Chinese IP addresses
• The malware exploits Tendyron OnKey software, which is primarily used in China’s financial and government sectors
• A SoftEther VPN connection originating from a Virtual Private Server was traced to one of the C2 nodes
• The targeting pattern aligns with data collection operations supporting pattern-of-life analysis

The broad targeting scope suggests an intelligence-gathering operation rather than a financially motivated cybercrime campaign. Mobile apps and smartwatches connected to cellular networks could enable pattern-of-life analysis, while targeting financial organizations might expose transaction data and attacking hospitality systems could reveal travel history.

Defensive Recommendations

Organizations concerned about BambooToken and similar MQTT-based threats should consider the following defensive measures:

• Monitor MQTT traffic: Implement network monitoring rules to detect unauthorized MQTT communications, especially on non-standard ports
• Audit DLL sideloading: Use EDR tools capable of detecting DLL sideloading attacks, particularly for trusted security software binaries
• Restrict unnecessary protocols: Block MQTT traffic at the network perimeter unless there is a legitimate business requirement
• Monitor WMI queries: Track unusual WMI queries that enumerate installed security products
• Update security tokens: Ensure that PKI USB token software, including Tendyron OnKey, is updated to versions that are not vulnerable to DLL sideloading
• Implement network segmentation: Isolate critical systems from segments where compromised IoT devices or routers could serve as attack vectors

The Broader Implications

The discovery of BambooToken underscores a growing trend in the cybersecurity landscape: threat actors are increasingly repurposing legitimate, lightweight protocols to evade detection. As organizations invest heavily in detecting traditional C2 channels like HTTP and HTTPS, attackers are finding new communication paths that blend into normal network traffic.

The cross-platform nature of BambooToken, targeting both Windows and Linux systems, also reflects the evolving threat landscape where attackers are no longer limiting their focus to a single operating system. With Linux systems powering much of the world’s server infrastructure and IoT ecosystem, cross-platform malware represents a significant and growing risk.

As Lumen Black Lotus Labs concluded in their report, the combination of MQTT for controlling numerous clients from a central point, combined with routing via Cloudflare, enables large-scale operations through unconventional communication methods. This campaign’s targeting supports extensive data collection that could have far-reaching implications for organizations across multiple sectors and geographies.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous