What BambooToken is
BambooToken is a multi-platform malware framework supporting both Windows and Linux. It includes a full suite of surveillance capabilities: keylogging, clipboard monitoring, audio recording via the system microphone, webcam capture, screenshot collection, and file download and deletion. Lumen Black Lotus Labs identified samples on VirusTotal in early 2026, with activity traces extending back to February 2023 and the most recent confirmed activity in July 2026.
The malware is attributed to a skilled, persistent threat actor that has targeted organizations in Asia and South America, including servers used by mobile applications, legal and financial services, and software development companies. No formal attribution to a nation-state has been published.
Why MQTT
MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe messaging protocol designed for IoT devices and low-bandwidth applications. It relies on a central broker: publishers send messages to the broker on named topics, and subscribers receive them. A command-and-control implementation using MQTT routes operator commands through a public or attacker-controlled MQTT broker rather than a dedicated C2 server.
This approach is evasive for several reasons. MQTT traffic blends with the large volume of legitimate IoT device communication in enterprise networks. The protocol uses a central broker, which means network defenders see traffic to the broker, not to an attacker-controlled server, making domain or IP blocklisting ineffective. Most security monitoring tools do not parse MQTT message content for malicious patterns. And because MQTT runs on port 1883 (plaintext) or 8883 (TLS), it can be confused with legitimate IoT or device management traffic.
BambooToken variants developed between 2024 and 2025 adopted MQTT specifically. Earlier variants used more conventional HTTP-based C2. The switch suggests the operators deliberately chose MQTT for evasion, and the three-year detection gap suggests the approach worked.
How it gets in
Initial delivery relied on DLL sideloading via Tendyron's OnKey software, a legitimate USB security key product. The actor used the legitimate application as a sideloading vehicle to execute BambooToken components in the context of a trusted process. This technique makes initial process execution appear legitimate and can bypass application-allowlisting controls that do not validate loaded modules.
What defenders should check
Organizations that have network monitoring should verify whether MQTT traffic (TCP ports 1883 and 8883) is being inspected or at minimum logged. A host initiating outbound MQTT connections that is not an IoT device or IoT management server is anomalous and worth investigating.
For environments with endpoint detection tools, look for DLL sideloading patterns involving legitimate signed applications loading unsigned or unexpected DLLs from writable directories. Tendyron OnKey is a specific indicator for this family, but the technique is broad. Lumen Black Lotus Labs published an IOC package alongside the research.
The detection gap this exposes
The deeper issue is protocol monitoring coverage. HTTP and HTTPS C2 get extensive attention from detection teams, largely because most malware uses them. MQTT, WebSocket, XMPP, and other application-layer protocols with legitimate enterprise uses are frequently uninspected. BambooToken exploited this gap for years. Any organization that has not reviewed its monitoring coverage across the full set of protocols reachable from workstations and servers has an unknown detection gap of similar character.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization needs help reviewing detection coverage gaps or threat hunting for novel C2 patterns.