# BambooToken Malware Uses MQTT Protocol for Cross-Platform Windows/Linux C2

> BambooToken is a multi-platform (Windows and Linux) malware family active since at least February 2023 that uses the MQTT publish-subscribe protocol as its C2 channel, delivered in part via DLL side-loading of a vulnerable Tendyron OnKey banking-security-token binary, and has compromised roughly a dozen organizations across Asia and South America through July 2026.

- **Published:** 2026-09-15T00:00:00Z
- **Last reviewed:** 2026-09-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2520
- **ID:** TL-2026-2520
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BambooToken is a cross-platform malware family, initially Windows-only and expanded to Linux as of December 2025, that stands out for using the MQTT (Message Queuing Telemetry Transport) publish-subscribe protocol -- normally used for IoT telemetry -- as its command-and-control channel rather than conventional HTTP(S) C2. Lumen's Black Lotus Labs, which discovered the family after samples surfaced on VirusTotal in January 2026, documented the operation in the report 'The Banana Stand: Brokering and Managing Infections Across Asia Using MQTT.' The malware implements MQTT via the open-source Eclipse Mosquitto library; the broker architecture means the compromised host never communicates directly with the operators' server, only with the broker, which relays messages by GUID-scoped topic.

The primary observed delivery mechanism is DLL side-loading through Tendyron's OnKey software: the operators abuse the legitimate, validly-signed OnKeySrv.exe (used with Tendyron's PKI USB banking security tokens, popular in Chinese banking and government networks) to load a malicious OnKeyToken_KEB.dll. Initial execution begins with a file named Update.log, which spawns a remote thread and injects the payload into memory (process injection) rather than executing from disk directly. Black Lotus Labs also documented a secondary delivery variant impersonating 'Zhuhai Kingsoft Office Software Co., Ltd.' -- a legitimate Chinese office-suite vendor -- via a forged code signature; the researchers confirmed the threat actors did not obtain Zhuhai's actual code-signing certificate, and signature validation on the impersonating component fails, ruling out a supply-chain compromise of either Tendyron or Zhuhai and pointing instead to invalid/spoofed code-signature masquerading.

Once running, BambooToken extracts its C2 address from OnKeySrv.dat configuration files (parsing markers '&#'/'#&' for the C2 IP and '$@'/'@$' for beacon host profiles) or falls back to a hardcoded, XOR-encoded address; multiple samples share the same XOR key, letting Black Lotus Labs cluster them. A hardcoded, XOR-decoded GUID (e.g. '{5861573B-FF85-4C7A-BBAD-EFC01540357D}' in Version 1, '{534E19D5-434B-4cad-A0C2-8D75E0B2FBFC}' in the Linux Version 2.1) is used as a mutex to prevent multiple concurrent agent instances on the same host. The malware supports three command handlers over MQTT: SHELL (spawns a command shell in a new thread), FILEEX (download, upload, and delete files, plus stop-execution/exit), and ONLINE (a heartbeat beacon carrying extensive host enumeration). Version 2.0 (Windows) added a GUID-scoped topic structure (Plugin/unPlugin/removePlugin) and Version 2.1 (Linux) added an additional 'LUA' topic. Static analysis recovered dead, unused code referencing planned-but-unshipped plugins -- KEY_RECOURD (keylogger), COM_clipboard, and COM_ modules for audio, webcam, and desktop-screen capture -- indicating the plugin architecture evolved from a monolithic 2023 build toward a modular 2024+ design.

A dedicated Windows plugin uses WMI (Windows Management Instrumentation), polling roughly every five seconds, to enumerate installed antivirus products and exfiltrate the inventory via an HTTP GET request (not MQTT) to api80.c2iznja[.]com with a spoofed 'HTTP Downloader' user agent -- a defense-evasion and environment-profiling step ahead of further activity. The malware also queries the external service icanihazip[.]com to resolve its own public IP address.

Infrastructure analysis found a SoftEther VPN connection from a Virtual Private Server in Hong Kong to the C2 node at 202.144.192[.]149 -- Black Lotus Labs assesses SoftEther VPN usage originating from Hong Kong VPS infrastructure as 'a known TTP of various PRC-aligned actors,' and correlated timing between China Mobile IP connections to that SoftEther endpoint and subsequent C2 activity, though the entity behind the China Mobile address itself was not identified. Separately, a December 2025 SNMP (port 161) scanning campaign hit over 150 unique MikroTik and DrayTek router IPs across Southeast Asia in a single day; a subset showed sustained MQTT (port 1883) connections to BambooToken C2 nodes afterward, indicating successful compromise and use as relay/proxy infrastructure. Routers in Singapore, Cambodia, and Vietnam were also observed connecting via 'speedCN,' a VPN service marketed to overseas Chinese users for accessing mainland Chinese websites, suggesting a diaspora-population targeting angle. Multiple C2 domains (including cache.c2iznja[.]com and several chat5188[.]tk subdomains) sit behind Cloudflare, obscuring true origin infrastructure; chat5188[.]tk reached Cloudflare Radar's top 1,000,000 domains by December 2024 and c2iznja[.]com reached the top 500,000 by December 2025, which the researchers cite as evidence of an operator experienced at running wide-reaching campaigns.

Attribution is assessed as PRC-aligned with medium-high confidence, based on: the majority of samples being uploaded from Chinese IP space with corresponding China-based C2 telemetry; use of Tendyron OnKey tokens common in Chinese banking/government environments; the SoftEther-VPN-from-Hong-Kong TTP; deliberate anti-forensic operational security (forged PE compilation metadata claiming Windows Server 2003/Visual Studio 2005 with intentionally varied timestamps to prevent signature clustering); and a targeting pattern -- testing capability against discreet regional/diaspora targets before likely broader expansion -- that mirrors the historical playbook of PRC-nexus actors such as Volt Typhoon, GhostEmperor, and ZuoRAT. Shared RichPE header data across 2024 and 2025 campaign samples indicates a common codebase and development environment maintained by the same operator over time. No specific named threat actor or group was attributed, and Black Lotus Labs found no technical overlap with PlugX/Korplug despite both malware families having used MQTT-adjacent or MQTT-based channels historically; researchers describe BambooToken as an 'emerging threat cluster' with no public correlation to previously documented activity.

Approximately a dozen compromised entities were identified during the investigation, spanning several mobile-application backend servers, a GitLab server in Hong Kong, a portable-lifestyle-device manufacturer and a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania, and a financial organization in Malaysia. The concentration of mobile-application-server victims suggests an extensive data-collection operation. Researchers noted BambooToken sits in a small cohort of malware families that abuse MQTT for C2, alongside MQsTTang (Mustang Panda/CeranaKeeper, 2023), Tizi (Android spyware, in some C2 modes), WailingCrab/WikiLoader (Bamboo Spider cybercrime group), and IOCONTROL/OrpaCrab (Iran-linked OT/IoT malware) -- named by the source reporting as comparators, not as related campaigns.

## MITRE ATT&CK

- T1574.001 DLL
- T1071.005 Publish/Subscribe Protocols
- T1090.002 External Proxy
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1047 Windows Management Instrumentation
- T1129 Shared Modules
- T1584.008 Network Devices
- T1027 Obfuscated Files or Information
- T1571 Non-Standard Port
- T1005 Data from Local System
- T1059 Command and Scripting Interpreter
- T1070.004 File Deletion
- T1036.001 Invalid Code Signature
- T1055 Process Injection
- T1016.001 Internet Connection Discovery
- T1595.002 Vulnerability Scanning

## Sources

- [BambooToken Malware Uses MQTT to Control Windows and Linux Systems](https://thehackernews.com/2026/09/bambootoken-malware-uses-mqtt-to.html)
- [The Banana Stand: Brokering and Managing Infections Across Asia Using MQTT](https://www.lumen.com/blog/en-us/the-banana-stand-brokering-and-managing-infections-across-asia-using-mqtt)
- [Tendyron OnKey / 2G Token product page](https://www.tendyron.com/en/product/2gtoken.html)
- [MQsTTang: Mustang Panda's latest backdoor treads new ground with Qt and MQTT](https://www.welivesecurity.com/2023/03/02/mqsttang-mustang-panda-latest-backdoor-treads-new-ground-qt-mqtt/)
- [Stealthy WailingCrab Malware misuses MQTT Messaging Protocol](https://www.ibm.com/think/x-force/wailingcrab-malware-misues-mqtt-messaging-protocol)
- [Inside a New OT/IoT Cyberweapon: IOCONTROL](https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol)
- [Iranian Hackers Use IOCONTROL Malware to Target OT, IoT Devices in US, Israel](https://www.securityweek.com/iranian-hackers-use-iocontrol-malware-to-target-ot-iot-devices-in-us-israel/)
- [Tizi: Detecting and blocking socially engineered spyware on Android](https://security.googleblog.com/2017/11/tizi-detecting-and-blocking-socially.html)
- [Webworm Deploys EchoCreep and GraphWorm (SoftEther VPN tradecraft precedent)](https://thehackernews.com/2026/05/webworm-deploys-echocreep-and-graphworm.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2520