BambooToken Malware Uses MQTT to Control Windows and Linux Systems
Summary
Black Lotus Labs found BambooToken, active since at least 2023, using MQTT for command-and-control on Windows and Linux. Researchers linked it to compromised enterprise systems but could not attribute it to a specific actor.
Key points
- BambooToken variants developed between 2024 and 2025 use MQTT topics to receive commands and report system information.
- The malware infected systems through sideloading with signed Tendyron OnKey USB-token software or by impersonating Kingsoft Office.
- Researchers found a plugin that enumerates antivirus products and reports results to command-and-control.
- Code strings suggest possible keylogging, clipboard theft, audio recording, webcam capture, and screenshots, but these were found in dead code and may not have been used.
- A Linux variant observed in December 2025 can collect system information, spawn a shell, and upload, download, or delete files; researchers said it appeared to be under development.
- Lumen telemetry identified about a dozen compromised entities, mostly in Asia and South America, including servers associated with mobile app backends and a GitLab server in Hong Kong.
- Researchers could not identify a specific threat actor; targeting patterns were described as consistent with China-aligned operations.
Article Details
- Event Type
- Discovery and reporting of BambooToken malware campaigns using MQTT for command-and-control on Windows and Linux systems.
- Impact
- BambooToken compromised approximately a dozen enterprise entities, primarily in Asia and South America, including organizations in hotel, biomedical, legal, financial, and cryptocurrency sectors, as well as mobile-app backend servers. A GitLab server in Hong Kong was also compromised, creating a potential supply-chain foothold. Researchers found code strings indicating possible keylogging, clipboard theft, audio recording, webcam capture, and screenshots, but could not confirm those modules were deployed or used.
Malware
Vendors
Products
Kingsoft Officeby side-loading via a digitally signed Tendyron OnKey USB-token software or by impersonating the Kingsoft Office productivity suite.SpeedCN VPNLumen hypothesizes that some of the activity may have targeted overseas Chinese users accessing mainland services through the SpeedCN VPN service.Tendyron OnKeyarm, Black Lotus Labs, notes that BambooToken infected systems by side-loading via a digitally signed Tendyron OnKey USB-token software or by impersonating the Kingsoft Office productivity suite.
Countries
Industries
biomedicala dozen compromised enterprise entities, mostly in Asia and South America, including hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency website in Lithuania.Cryptocurrencyand South America, including hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency website in Lithuania.financialBlack Lotus Labs found it in campaigns targeting enterprise servers and infrastructure used by mobile apps, legal and financial services, with signs of possible China-aligned operations.LegalBlack Lotus Labs found it in campaigns targeting enterprise servers and infrastructure used by mobile apps, legal and financial services, with signs of possible China-aligned operations.Software developmentThe malware adopted MQTT for command-and-control communications in variants developed between 2024 and 2025, compromising servers used by mobile apps, legal and financial services, and software development.