BambooToken: The MQTT-Based Malware Evading Detection
Stealthy malware uses IoT protocol to control infected systems across Asia and beyond.
1Novel MQTT communication
BambooToken represents a new malware family that uniquely utilizes MQTT, a lightweight messaging protocol common in IoT devices, for command-and-control. Unlike traditional malware that connects directly to C2 servers, BambooToken routes communications through an MQTT broker, making detection more challenging. This approach hides the attacker's infrastructure behind the broker, with infected machines never directly contacting the C2 server. The asynchronous nature of MQTT allows compromised systems to go offline and reconnect without disrupting operations.
2Multi-platform campaign
Active since February 2023, BambooToken targets both Windows and Linux systems across Asia and Latin America. Researchers discovered the malware through VirusTotal analysis, tracing variants back nearly three years. The campaign shows signs of disciplined development, with compilation timestamps suggesting use of isolated build environments or careful timestamp forgery. The malware's evolution includes a shift from HTTP to MQTT communications between 2024-2025, along with the addition of sideloading capabilities.
3Sideloading via trusted software
BambooToken infiltrates Windows systems by abusing Tendyron's 'OnKey' software, a hardware-token product used in Chinese banks and government agencies. The malware exploits legitimate, signed binaries vulnerable to loading attacker files, without compromising the original certificates. One variant impersonates Kingsoft Office, a popular Microsoft alternative in China. Researchers confirmed neither company's signing certificates were actually breached, highlighting the malware's sophisticated abuse of trusted software.
4Linux variant emerges
By December 2025, a Linux version appeared with basic command handlers for shell access, file transfer, and system information collection. While less polished than Windows versions, it shares operational patterns confirming a common operator. The Linux variant expanded collected host information and adopted new MQTT topics. Both versions include inactive code for advanced capabilities like keylogging, clipboard theft, and audio/video capture, suggesting potential future development.
5Target profile analysis
Victims fall into two groups: small network devices (MikroTik and DrayTek routers in Southeast Asia) and diverse enterprise infrastructure. The latter includes cryptocurrency-related mobile app backends, a Hong Kong GitLab instance, and organizations across Vietnam, Argentina, Chile, and Malaysia. The compromised GitLab server poses particular supply-chain risks, potentially affecting downstream users. Some router infections routed through SpeedCN VPN, possibly indicating targeted surveillance of Chinese diaspora.
6Operational security measures
BambooToken operators demonstrate advanced anti-forensic practices, including varied compilation timestamps within plausible ranges. This level of discipline exceeds typical cybercriminal operations, suggesting state-aligned actors. The malware's staged rollout resembles tactics seen from groups like Volt Typhoon and GhostEmperor, with testing before scaling against high-value targets. Some victim patterns align with PRC-aligned tradecraft, though attribution remains unconfirmed.
7Unconventional scale indicators
Two command domains appeared in Cloudflare Radar's popularity rankings, indicating widespread deployment beyond test environments. The malware's MQTT architecture enables centralized control of numerous clients, facilitating large-scale operations. Cloudflare routing further obscures traffic. These factors suggest an operation of significant scope, with infrastructure designed for persistent access rather than quick compromise.
8Defensive recommendations
Organizations should monitor outbound MQTT traffic, especially when no legitimate devices use it. Router security must include SNMP traffic restrictions and changed default credentials. EDR tools should detect lateral movement, not just known signatures. Large outbound transfers warrant investigation regardless of destination. The report emphasizes checking MQTT traffic rather than assuming it originates from benign IoT devices, as these protocols become new attack vectors.
Original article: Security Affairs — BambooToken: The MQTT-Based Malware Evading Detection