# BambooToken Malware Exploits MQTT Protocol for Cross-Platform Attacks Sophisticated campaign targets Windows and Linux systems across Asia and South America since 2023. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0ffc2765-c49f-4320-8824-244f455ac312 ## Multi-platform malware campaign BambooToken malware uses MQTT protocol for command-and-control, targeting both Windows and Linux systems since February 2023. The campaign has been active through July 2026, primarily affecting organizations in Asia and South America. Lumen Black Lotus Labs discovered the previously undocumented malware on VirusTotal in early 2026. The initial access vector remains unknown, but the malware has evaded detection until recently. ## Tendyron OnKey exploitation Attackers abuse Tendyron's OnKey PKI security tokens, normally used for high-security authentication in financial and government sectors. While Tendyron's certificates aren't compromised, attackers exploit DLL sideloading vulnerabilities in the software. Tendyron claims 190 million tokens in circulation, making this a potentially widespread threat vector. Most BambooToken samples were uploaded to VirusTotal from Chinese IP addresses. ## MQTT as C2 channel BambooToken uses the lightweight MQTT protocol for command-and-control, similar to Mustang Panda's MQsTTang backdoor from 2023. The malware first extracts C2 server details from a .DAT file or uses hardcoded servers. It collects system information and receives commands to load plugins, terminate execution, or disconnect. Subsequent versions target Linux while maintaining MQTT communication. ## Evolution of attack techniques Initial versions used PowerShell scripts as stagers, while later versions shifted to DLL sideloading to evade endpoint detection. The malware collects extensive host information and delivers an AV plugin that uses WMI to identify installed security products. Cloudflare proxies hide C2 infrastructure, with one domain reaching top 500,000 in Cloudflare Radar rankings. ## Geographical targeting patterns Compromised IPs geolocate to Singapore, Cambodia, and Vietnam, communicating with C2 nodes via MikroTik and DrayTek routers. Victims include mobile apps, a Hong Kong GitLab server, Vietnamese lifestyle device developers, hotels, biomedical firms, legal practices, crypto sites, and financial organizations across Asia and South America. ## Potential China connection DLL sideloading combined with SoftEther VPN connections from VPS to C2 nodes suggests Chinese origins. While no direct link exists, BambooToken emerged around the same time as Mustang Panda's MQsTTang in early 2023. Researchers speculate attackers may have borrowed techniques from nation-state playbooks to implement MQTT capabilities. ## Data collection objectives The campaign appears focused on extensive data harvesting. Mobile apps and smartwatches could enable pattern-of-life analysis, financial targets may expose transaction data, while hospitality systems reveal travel history. The combination of MQTT control and Cloudflare routing enables large-scale operations through unconventional channels. ## Ongoing security implications BambooToken demonstrates advanced actors adapting enterprise protocols like MQTT for stealthy C2. The use of legitimate security software vulnerabilities highlights supply chain risks. With infrastructure ranking in Cloudflare's top domains, the campaign's scale suggests significant ongoing threat to organizations using Tendyron products or MQTT implementations. ## Sources covering this story - https://thehackernews.com/2026/09/bambootoken-malware-uses-mqtt-to.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._