A newly documented malware framework called BambooToken is using a messaging protocol normally associated with Internet of Things devices to control compromised Windows and Linux systems while avoiding direct communication with attacker infrastructure.
Researchers at Lumen’s Black Lotus Labs say the malware has been active since at least 2023 and later adopted the Message Queuing Telemetry Transport, or MQTT, protocol for command-and-control communications.
The malware has been found on systems linked to mobile application infrastructure, legal and financial services, biomedical organisations and software development environments.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
MQTT lets attackers hide behind a messaging broker
MQTT is a lightweight messaging protocol commonly used by IoT devices.
Instead of two systems communicating directly, messages are sent through a central broker. Devices subscribe to specific channels, known as topics, and receive messages published to those topics.
BambooToken abuses that same model.
The infected machine subscribes to a topic associated with its unique identifier. The attacker can then publish commands to that topic, while the compromised system sends status information and results back through the broker.
The practical advantage for the attacker is separation.
The compromised computer does not need to connect directly to the attacker’s own command server.
That makes the communication chain more resilient and can make malicious traffic harder to distinguish from legitimate MQTT activity.
The system can also continue working asynchronously if either side temporarily loses connectivity.
Malware reached systems through legitimate-looking software
Black Lotus Labs identified two notable infection methods.
In one case, BambooToken was side-loaded through digitally signed software associated with Tendyron OnKey USB-token products.
In another, the malware impersonated the Kingsoft Office productivity suite.
DLL side-loading abuses the way legitimate applications load supporting files.
An attacker places a malicious DLL where a trusted program expects to find a legitimate one. When the genuine application starts, it can unknowingly load and execute the attacker’s code.
That allows malware to run under the cover of legitimate software, making detection more difficult.
The use of signed or recognisable applications can also make the initial files appear less suspicious to users and security tools.
Windows version can receive commands and report system details
Researchers recovered BambooToken components capable of collecting system information and communicating with operators through MQTT.
The malware can receive instructions and report information about the infected host back through the messaging broker.
Black Lotus Labs also recovered a plugin that lists antivirus products installed on the compromised system and sends that information to the command-and-control infrastructure.
Knowing which security products are present can help an attacker decide what to do next.
The malware code also contained references to keylogging, stealing clipboard contents, recording audio, accessing webcams and taking screenshots.
However, researchers found those strings in dead code.
That means there is not enough evidence to say those surveillance functions were active or used against victims.
Linux variant shows BambooToken is becoming cross-platform
Researchers also identified a Linux version, BambooToken 2.1, observed in December 2025.
That variant also uses MQTT for communication and can gather extensive system information, create a command shell and upload, download or delete files.
Black Lotus Labs cautioned that the Linux sample still appeared to be under development.
Even so, its existence is significant.
Attackers increasingly need malware that works across more than one operating system because modern organisations often run Windows employee machines alongside Linux servers and cloud infrastructure.
A cross-platform command-and-control framework gives operators flexibility after they enter a network.
Around a dozen enterprise victims identified
Lumen’s telemetry linked BambooToken activity to roughly a dozen compromised organisations, mainly in Asia and South America.
Victims included hotels, biomedical companies, law firms and a financial organisation. Researchers also found a cryptocurrency website in Lithuania connected to the activity.
Many of the compromised servers were associated with backend infrastructure used by mobile applications.
Researchers also identified a compromised GitLab server in Hong Kong.
That is particularly concerning because developer infrastructure can create opportunities for supply-chain attacks if attackers are able to manipulate code, credentials or software delivery processes.
Black Lotus Labs has not attributed BambooToken to a specific known threat group.
The researchers said the targeting pattern is consistent with China-aligned activity, but that assessment remains a hypothesis rather than a confirmed attribution.
Why MQTT creates a detection problem
Many organisations expect MQTT traffic from sensors, industrial systems and other connected devices.
Security teams may therefore focus more heavily on suspicious HTTP, HTTPS or DNS traffic when looking for malware command-and-control activity.
BambooToken exploits that assumption.
A Windows workstation or application server communicating with an external MQTT broker may not immediately stand out if the protocol is not closely monitored.
The defensive lesson is not to block MQTT everywhere.
It is to understand which systems genuinely need it.
A finance server, legal workstation or ordinary corporate endpoint unexpectedly making MQTT connections should attract attention if that behaviour has no business reason.
Lumen has shared indicators of compromise with defenders so organisations can identify and block known infrastructure associated with the campaign.
What this means for you: This threat is mainly relevant to organisations and security teams rather than ordinary home users. Companies should monitor unexpected MQTT traffic from Windows and Linux systems, review software-loading behaviour and investigate endpoints connecting to unfamiliar external brokers.
The420 Insight: BambooToken’s most interesting feature is not another malware capability. It is the choice of communication channel. By borrowing a protocol normally associated with IoT devices, the attackers can make malicious command traffic look more like routine machine-to-machine communication.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
