# BambooToken: Cross-Platform Windows/Linux Malware Using MQTT C2, Delivered via Tendyron OnKey DLL Side-Loading and Kingsoft Office Impersonation

> BambooToken is a cross-platform (Windows and Linux) malware framework active since 2023 that uses the MQTT IoT messaging protocol for command-and-control, letting infected hosts subscribe to attacker-published broker topics instead of connecting directly to attacker infrastructure. Lumen's Black Lotus Labs identified roughly a dozen compromised entities across Asia and South America, delivered via DLL side-loading of a digitally signed Tendyron OnKey USB-token utility and impersonation of the Kingsoft Office suite, with targeting patterns consistent with China-aligned operations.

- **Published:** 2026-09-15T00:00:00Z
- **Last reviewed:** 2026-09-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2519
- **ID:** TL-2026-2519
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BambooToken is a malware family tracked by Lumen's Black Lotus Labs that has been active since at least 2023 and gained an MQTT-based command-and-control transport in its 2024-2025 variant lineage. Rather than beaconing directly to attacker-controlled infrastructure, infected Windows and Linux hosts subscribe to unique-identifier topics on a central MQTT broker while the attacker publishes tasking to those same topics; this broker-mediated, topic-based design lets the operators issue commands asynchronously, survive network disruption, and avoid exposing a fixed C2 endpoint to defenders monitoring for direct outbound callbacks. The newest confirmed variant, BambooToken v2.1 for Linux, was observed in December 2025 and demonstrates ongoing active development; per Black Lotus Labs it retains MQTT communications alongside system enumeration, remote command-shell spawning, and file upload/download/delete operations carried out over the same C2 channel.

Initial delivery relies on two techniques: DLL side-loading of a legitimately, digitally signed Tendyron OnKey USB-token utility, and masquerading as the Kingsoft Office productivity suite. The Tendyron OnKey side-loading vector is notable because the same signed-binary family (Tendyron.exe alongside a malicious OnKeyToken_KEB.dll placed to win Windows' DLL search order) was previously documented by ESET in 2022 as the first-stage loader used by the China-aligned TA410 umbrella / FlowingFrog cluster to deploy the FlowCloud backdoor via shellcode injected into iexplore.exe. BambooToken's reuse of the same abusable signed Tendyron software as a side-loading carrier is consistent with, though not proof of, the China-aligned targeting pattern Black Lotus Labs describes for this campaign; researchers were unable to reach a definitive actor attribution.

Black Lotus Labs identified roughly a dozen compromised organizations concentrated in Asia and South America. Confirmed or reported victim types include hotels, biomedical firms, law firms, financial organizations, a Lithuania-based cryptocurrency website, mobile application backend infrastructure (the most commonly affected victim category), and a GitLab server in Hong Kong assessed to carry supply-chain attack potential given GitLab's role hosting source code and CI/CD pipelines. Researchers also flagged a possible link to targeting of the SpeedCN VPN service, suggesting an interest in overseas Chinese VPN users consistent with an espionage-oriented, rather than purely financial, motivation.

Static analysis surfaced strings in dead/inactive code sections referencing antivirus-product enumeration, keylogging, clipboard theft, audio recording, webcam capture, and screenshot capture. Black Lotus Labs could not confirm whether these modules are operational, dormant, or still under development, so they are documented here as an identified-but-unconfirmed capability set rather than observed active behavior. No CVE or CVSS score applies to this threat: BambooToken is a malware delivery and C2 framework abusing legitimate signed software and MQTT infrastructure rather than a specific software vulnerability. Lumen states it has shared indicators of compromise to help defenders detect and block the activity.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1071 Application Layer Protocol
- T1005 Data from Local System
- T1056.001 Keylogging
- T1123 Audio Capture
- T1125 Video Capture
- T1113 Screen Capture

## Sources

- [BambooToken malware controls Windows and Linux systems via MQTT](https://www.bleepingcomputer.com/news/security/bambootoken-malware-controls-windows-and-linux-systems-via-mqtt/)
- [A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity (Tendyron.exe / OnKeyToken_KEB.dll DLL side-loading to FlowCloud)](https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/)
- [Black Lotus Labs | Lumen Technologies (threat research publication hub)](https://www.lumen.com/blog-and-news/en-us/black-lotus-labs)
- [Black Lotus Labs indicators-of-compromise repository](https://github.com/blacklotuslabs/IOCs)
- [herdProtect signer analysis: Tendyron Corporation](https://www.herdprotect.com/signer-tendyron-corporation-049f96ed633636323eaad7014c8272e3.aspx)
- [SpyShelter analysis: OnKey_Install_Silent.exe (Tendyron)](https://www.spyshelter.com/exe/tendyron-corporation-onkey_install_silent-exe/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2519