Lumen Details BambooToken Malware Campaign Using MQTT to Target Windows and Linux Systems

Mar 16, 2026 · Original article ↗

Summary

Lumen researchers describe BambooToken, a Windows and Linux malware family active since at least 2023 that uses MQTT for command and control. Their telemetry links the campaign to targets in Asia and South America.

Key points

Researchers assess that BambooToken has been active since at least February 2023; they found Windows and Linux variants, with the Linux sample first observed in December 2025.
Windows variants were sideloaded through legitimate software, including Tendyron’s OnKey program; Lumen says it found no evidence that the software makers’ signing certificates were compromised.
MQTT lets the malware communicate through a broker, using topic subscriptions to receive commands and report host status.
Handlers identified in the samples can open a shell, transfer or delete files, and send host information. A Windows plugin also collects information about installed antivirus products.
Lumen telemetry associated infections with mobile app backends, a GitLab server, software developers, a hotel and organizations in legal, financial and other sectors, mostly in Asia and with some in South America.
Lumen recommends mapping software dependencies, securing routers and SNMP, monitoring for unusual MQTT traffic and large outbound transfers, and using updated endpoint detection and centralized monitoring.
Lumen assesses that BambooToken’s operators may have surveillance capabilities; some additional capabilities, including possible keylogging and webcam capture, were suggested by strings in unexecuted code, not confirmed active functions.

Article Details

Attack Vectors: The Windows agent was sideloaded through the legitimate Tendyron OnKey program; the article says the signed executable appeared benign and does not assess that Tendyron’s code-signing certificate was compromised.
BambooToken used MQTT for command-and-control communications between infected Windows and Linux systems and C2 infrastructure.
The malware collected host and antivirus information and sent it to C2; its handlers also supported shell access and file download, upload, and deletion.
Lumen observed internet-wide scanning on port 161 associated with SNMP and suspected attempts to exploit the service against routers; exploitation was not confirmed.
Defensive Notes: Map supply chains and code dependencies, and maintain a proper CI/CD pipeline.
Patch routers, prevent external SNMP requests, and replace default community strings and passwords.
Use updated EDR and centralized monitoring for lateral movement.
Use firewall rules to detect anonymous traffic and abnormal protocols such as MQTT leaving the network.
Monitor large outbound data transfers, including transfers to destinations in the same geographic area.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`api06[.]chat5188[.]tk`	Historical BambooToken C2 domain listed as hidden behind Cloudflare.
DOMAIN	`api08[.]chat5188[.]tk`	Historical BambooToken C2 domain listed as resolving to 210.1.226[.]236.
DOMAIN	`apis[.]chat5188[.]tk`	Historical BambooToken C2 domain listed as hidden behind Cloudflare.
DOMAIN	`base64[.]c2iznja[.]com`	Listed as a hostname corresponding to BambooToken C2 infrastructure.
DOMAIN	`cache[.]c2iznja[.]com`	Listed as a BambooToken C2 domain hidden behind Cloudflare.
DOMAIN	`chat[.]chat5188[.]tk`	Historical BambooToken C2 domain listed as hidden behind Cloudflare.
DOMAIN	`live-hk[.]c2iznja[.]com`	Hardcoded C2 domain in the Linux BambooToken sample.
DOMAIN	`newdma[.]c2iznja[.]com`	Listed as a hostname corresponding to BambooToken C2 infrastructure.
DOMAIN	`turbo[.]c2iznja[.]com`	C2-associated hostname observed resolving to 210.1.231[.]13.
IPV4	`202[.]144[.]192[.]149`	Active BambooToken C2 node associated with MQTT communications and c2iznja[.]com hostnames.
IPV4	`202[.]144[.]192[.]23`	Listed as a BambooToken command-and-control IP; MQTT was observed on this host.
IPV4	`210[.]1[.]226[.]163`	Listed as a BambooToken command-and-control IP.
IPV4	`210[.]1[.]226[.]238`	Listed as a BambooToken command-and-control IP, with SSL MQTT on port 8883.
IPV4	`210[.]1[.]231[.]13`	C2 infrastructure associated with both the newer c2iznja[.]com and historical chat5188[.]tk activity.
IPV4	`43[.]245[.]198[.]195`	Listed as a BambooToken command-and-control IP; MQTT was observed on port 1883.
IPV4	`43[.]245[.]198[.]238`	Listed as a BambooToken command-and-control IP; MQTT was observed on port 1883.
URL	`hxxp[:]//api80[.]c2iznja[.]com/Windows_Defender/Malwarebytes/`	C2 URL used by the antivirus plugin to transmit antivirus-product information.