BambooToken Malware Uses MQTT C2 to Target Windows and Linux Systems
Summary
Researchers say BambooToken has targeted organizations in Asia and South America since at least 2023. The malware uses MQTT for C2, evolved to support Linux, and may be delivered through Tendyron OnKey DLL sideloading.
Key points
- BambooToken has been active since at least February 2023, with activity detected as recently as July 2026.
- The malware uses MQTT for command-and-control, gathering host details and receiving commands from a C2 server.
- Researchers say earlier versions targeted Windows; versions from December 2025 also targeted Linux.
- The campaign likely uses DLL sideloading through Tendyron OnKey software, though the initial access vector remains unknown.
- A Windows plugin uses WMI to identify installed antivirus products and send details to C2; reported infrastructure includes chat5188[.]tk and api80[.]c2iznja[.]com.
- Researchers detected compromised entities in Asia and South America, including organizations in finance, hospitality, biomedical, legal, and technology sectors.
- The operator is unknown. DLL sideloading and a SoftEther VPN connection from a VPS suggest a possible China nexus, but researchers report no evidence linking BambooToken to Mustang Panda.
Article Details
- Attack Vectors
- Initial access vector remains undetermined.
- The malware likely used DLL sideloading through Tendyron OnKey software; the article says the OnKey program was used to sideload agents, while noting that Tendyron's code-signing certificate and build environment were not compromised.
- The first BambooToken version was initiated by a PowerShell stager that allocated memory and ran the malicious file.
- Defensive Notes
- Monitor for unexpected DLL sideloading involving Tendyron OnKey software and its OnKeySrv program.
- Investigate MQTT traffic for anomalous command-and-control activity, including communication with the reported BambooToken infrastructure.
- Monitor PowerShell activity that allocates memory and executes a malicious file, along with WMI-based collection of installed antivirus product details.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api80[.]c2iznja[.]com | C2 server to which the BambooToken Windows antivirus plugin exfiltrates information about installed antivirus products. |
| DOMAIN | chat5188[.]tk | BambooToken C2 server from which the malware receives commands after sending collected system details. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe malware transmits collected host and antivirus-product information to its C2 server.T1059.001 · PowerShellThe first BambooToken version was initiated by a PowerShell stager.T1082 · System Information DiscoveryBambooToken gathers system details from infected hosts.T1518.001 · Security Software DiscoveryThe Windows antivirus plugin uses WMI to enumerate installed antivirus products.T1574.002 · DLL Side-LoadingBambooToken reportedly sideloads a rogue DLL through Tendyron OnKey software and the OnKeySrv program.T1620 · Reflective Code LoadingThe initial PowerShell stager allocated memory and ran the malicious file.
People
Threat Actors
Malware
BambooTokenResearchers uncovered BambooToken, a multi-platform malware campaign that uses MQTT for command-and-control to target Windows and Linux systems across Asia and South America.IOCONTROLAn operational technology (OT) malware called IOCONTROL (aka OrpaCrab) that has targeted IoT and SCADA systems in Israel and the U.S.MQsTTang2023, the Chinese nation-state hacking group known as Mustang Panda was observed using a backdoor called MQsTTang that used the IoT messaging protocol to fetch and execute commands on compromised hosts.TiziAn Android malware called Tizi that can harvest sensitive data from various messaging and social media apps, as well as use HTTPS or MQTT for C2 to realize its goals.WailingCrabA malware loader called WailingCrab (aka WikiLoader) that’s distributed via delivery- and shipping-themed email messages.WikiLoaderA malware loader called WailingCrab (aka WikiLoader) that’s distributed via delivery- and shipping-themed email messages.
Vendors
Lumen Technologies“The first version of BambooToken was initiated via a PowerShell script,” Ryan English, information security engineer at Lumen Technologies Black Lotus Labs, told The Hacker News.TendyronThe campaign appears to rely on DLL sideloading through Tendyron OnKey software, with infrastructure and targeting suggesting extensive data collection and possible China-linked activity.
Products
Cloudflare#BambooTokenDrayTekThese IP addresses correspond to MikroTik and DrayTek routers.MikroTikThese IP addresses correspond to MikroTik and DrayTek routers.OnKeySrvSubsequent versions of the malware sideload a rogue version of a DLL (“OnKeyToken_KEB.dll”) used by the Tendyron OnKeySrv program to enumerate the host and enter into a command loop that uses MQTT for C2.SoftEther VPNBut the use of DLL sideloading, coupled with a SoftEther VPN connection originating from a Virtual Private Server (VPS) to one of the C2 nodes, suggests a China nexus.Tendyron OnKeyThe campaign appears to rely on DLL sideloading through Tendyron OnKey software, with infrastructure and targeting suggesting extensive data collection and possible China-linked activity.
Tools
MQTTResearchers uncovered BambooToken, a multi-platform malware campaign that uses MQTT for command-and-control to target Windows and Linux systems across Asia and South America.PowerShell“The first version of BambooToken was initiated via a PowerShell script,” Ryan English, information security engineer at Lumen Technologies Black Lotus Labs, told The Hacker News.Windows Management Instrumentationinformation and deliver an antivirus plugin for Windows that uses the Windows Management Instrumentation (WMI) framework to gather details about installed antivirus products on the machine and exfiltrate them to the
Countries
ArgentinaOther targets include a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania and a Malaysian finance organization.CambodiaThe threat research arm of Lumen also said it identified IP addresses geolocated to Singapore, Cambodia, and Vietnam communicating with one of the active C2 nodes.ChileOther targets include a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania and a Malaysian finance organization.ChinaThe campaign appears to rely on DLL sideloading through Tendyron OnKey software, with infrastructure and targeting suggesting extensive data collection and possible China-linked activity.Hong KongThe vast majority of the compromised servers are associated with mobile applications, as well as a GitLab server in Hong Kong and a Vietnamese company developing a portable lifestyle management device.IsraelAn operational technology (OT) malware called IOCONTROL (aka OrpaCrab) that has targeted IoT and SCADA systems in Israel and the U.S.LithuaniaOther targets include a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania and a Malaysian finance organization.SingaporeThe threat research arm of Lumen also said it identified IP addresses geolocated to Singapore, Cambodia, and Vietnam communicating with one of the active C2 nodes.United StatesAn operational technology (OT) malware called IOCONTROL (aka OrpaCrab) that has targeted IoT and SCADA systems in Israel and the U.S.VietnamThe threat research arm of Lumen also said it identified IP addresses geolocated to Singapore, Cambodia, and Vietnam communicating with one of the active C2 nodes.
Industries
biomedicalOther targets include a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania and a Malaysian finance organization.CryptocurrencyOther targets include a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania and a Malaysian finance organization.financialTheir website lists customers in China’s financial and government sectors, among other verticals”GovernmentTheir website lists customers in China’s financial and government sectors, among other verticals”Hospitalityanalysis; targeting financial organizations might expose transaction data, and attacking hospitality systems could reveal travel history and plans.”LegalOther targets include a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania and a Malaysian finance organization.Mobile applicationsThe vast majority of the compromised servers are associated with mobile applications, as well as a GitLab server in Hong Kong and a Vietnamese company developing a portable lifestyle management device.Operational technologyAn operational technology (OT) malware called IOCONTROL (aka OrpaCrab) that has targeted IoT and SCADA systems in Israel and the U.S.