BambooToken Malware Leverages MQTT for Cross-Platform Command and Control
A sophisticated malware family named BambooToken, active since early 2023, employs the MQTT protocol for command and control, targeting both Windows and Linux systems across Asia and South America.
Cybersecurity researchers have detailed a multi-platform malware campaign utilizing the Message Queueing Telemetry Transport (MQTT) protocol for command and control (C2) operations. The malware family, dubbed BambooToken, has been active since at least February 2023 and has been observed in attacks targeting organizations in Asia and South America, with recent activity detected as late as July 2026.
Lumen Black Lotus Labs discovered the previously undocumented malware on VirusTotal in early 2026. The threat actor behind BambooToken is assessed to be highly skilled, managing to remain undetected for an extended period. While the initial access vector remains undetermined, researchers suspect the attackers are exploiting a vulnerability in Tendyron's 'OnKey' software, a hardware-based token used for user authentication in high-security environments, particularly within China's financial and government sectors. The suspected method involves sideloading a malicious DLL into targeted machines that likely have the legitimate OnKey program installed.
The majority of BambooToken samples have been uploaded to VirusTotal from Chinese IP address ranges, suggesting a potential data collection campaign focused on users within and adjacent to China. The use of MQTT for C2 is not entirely novel; the Chinese nation-state group Mustang Panda was previously observed using a backdoor named MQsTTang with similar MQTT capabilities. Other documented instances of MQTT usage in malware include the Android malware Tizi, the WailingCrab loader, and the OT malware IOCONTROL.
Early versions of the BambooToken agent extracted C2 server information from a .DAT file or used a hard-coded fallback. After establishing communication, the malware gathered system details and sent them to the C2 server. In return, it received commands to load plugins, stop existing plugins, terminate its own execution, or disconnect. Subsequent iterations evolved to sideload a rogue DLL, "OnKeyToken_KEB.dll," used by the Tendyron OnKeySrv program. This allowed for host enumeration and initiated a command loop that leveraged MQTT for C2. By December 2025, BambooToken had expanded its reach to include Linux hosts, while still relying on MQTT for its C2 infrastructure.
The initial deployment of BambooToken involved a PowerShell script acting as a stager, allocating memory and executing the malicious file. The threat actor later shifted to DLL sideloading, likely to reduce the likelihood of detection by Endpoint Detection and Response (EDR) solutions. BambooToken is capable of collecting extensive host information. For Windows systems, it deploys an antivirus plugin that uses the Windows Management Instrumentation (WMI) framework to identify and exfiltrate details about installed antivirus products to the C2 server.
Domains associated with BambooToken's C2 infrastructure utilized Cloudflare as a proxy. One domain used in the 2025 campaign became a top 500,000 domain on Cloudflare Radar, and an older domain ranked in the top 1 million during its peak in 2024, indicating significant infection scale. IP addresses geolocated to Singapore, Cambodia, and Vietnam were observed communicating with active C2 nodes, corresponding to MikroTik and DrayTek routers. The campaign has compromised at least a dozen entities across Asia and South America.
Compromised targets include servers associated with mobile applications, a GitLab server in Hong Kong, a Vietnamese company developing a lifestyle management device, a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania, and a Malaysian finance organization. While the exact attribution remains unknown, the use of DLL sideloading and SoftEther VPN connections from VPSs to C2 nodes suggests a potential China nexus. The emergence of both MQsTTang and BambooToken around the same time in early 2023, despite no direct evidence of overlap, hints at the possibility that the BambooToken actor may have adopted MQTT techniques inspired by Mustang Panda.