BambooToken Malware Hides Command and Control Through MQTT Brokers

Lumen’s Black Lotus Labs has detailed BambooToken, a malware family targeting Windows and Linux systems through MQTT, a publish-and-subscribe messaging protocol widely used by smart devices and industrial systems. The researchers believe the campaign was active from at least February 2023 until July 2026, although they could not link it to a previously documented threat actor.

Rather than connecting directly to command-and-control infrastructure, infected systems communicate through an MQTT broker, allowing asynchronous communication and hiding the operator’s infrastructure. Lumen identified only three earlier malware families using MQTT in this way: IOCONTROL, Korplug and WailingCrab.

BambooToken initially used HTTP but adopted MQTT between 2024 and 2025, alongside Windows sideloading techniques. It was delivered with legitimate signed software associated with Tendyron’s OnKey hardware-token product, used by organisations including Chinese banks and government agencies, and in another variant impersonated Kingsoft Office.

Lumen said neither company’s signing certificate or build environment appeared to have been compromised; instead, the malware likely abused vulnerable loading behaviour in software already present on target networks. Its Linux capabilities include shell access, file transfers, deletion and system reconnaissance, while a Windows plugin checks installed antivirus software every five seconds. Researchers also found inactive code for keylogging, clipboard theft, audio recording and webcam or screen capture.

Victims included MikroTik and DrayTek routers in Singapore, Cambodia and Vietnam, plus enterprise systems in Asia and South America, including mobile-application backends, a GitLab server, a hotel, biomedical and financial firms, and a law firm. Lumen recommends reviewing supply-chain dependencies, securing routers against unsolicited SNMP traffic, monitoring unexpected outbound MQTT communications and investigating lateral movement and large data transfers.