Introduction: BambooToken Malware — Why It Matters
BambooToken Malware is an emerging multi-platform malware campaign that uses the lightweight Message Queuing Telemetry Transport (MQTT) protocol to communicate with compromised Windows and Linux systems. Researchers at Lumen Technologies’ Black Lotus Labs have linked the activity to attacks involving organizations across Asia and South America.
The malware has reportedly been active since at least February 2023, with related activity detected as recently as July 2026. Researchers discovered samples on VirusTotal in early 2026, while the initial method used to gain access to targeted systems remains undetermined.
The campaign stands out because it combines MQTT-based command-and-control (C2), DLL sideloading and information collection. These techniques can allow attackers to maintain communication with infected systems while attempting to avoid conventional detection.
What Is BambooToken Malware?
BambooToken Malware is a malware family designed to operate across Windows and Linux environments. Earlier versions reportedly extracted their C2 server address from a .DAT file or used a hard-coded address when that file was unavailable.
After establishing communication, the malware gathers information about the infected host and sends it to its C2 infrastructure. The server can then issue commands to load plugins, stop plugins, terminate the malware or disconnect the infected machine.
Later versions introduced a different execution technique involving Tendyron’s OnKey software. Researchers said the attackers used a rogue DLL, named OnKeyToken_KEB.dll, alongside the legitimate OnKeySrv program to trigger the malicious activity.
Who Is Behind the BambooToken Campaign?
The identity of the operators remains unknown. Black Lotus Labs has described the activity as consistent with a skilled threat actor that remained largely undetected for an extended period.
Researchers have pointed to possible China-related infrastructure and targeting patterns, but this does not establish the identity or affiliation of the operators. The use of DLL sideloading and a SoftEther VPN connection from a VPS to C2 infrastructure contributed to the assessment of a possible China nexus.
There is also no confirmed evidence connecting BambooToken Malware directly to Mustang Panda, despite both BambooToken and the previously documented MQsTTang backdoor using MQTT around the same period.
BambooToken Malware: Technical Breakdown
Timeline of Events
- February 2023: Activity associated with BambooToken is assessed to have begun.
- Early 2026: Black Lotus Labs identified previously undocumented samples on VirusTotal.
- December 2025: The malware had expanded to target Linux systems while continuing to use MQTT.
- July 2026: Related BambooToken activity was still being detected.
How the Malware Operates
The campaign has evolved through several execution methods:
- Earlier samples could use a PowerShell-based stager to execute malicious code.
- Later versions reportedly relied on DLL sideloading through Tendyron OnKey software.
- The malware collects system information from compromised hosts.
- An antivirus-focused plugin uses Windows Management Instrumentation (WMI) to identify installed security products.
- Collected information can be transmitted to attacker-controlled C2 infrastructure.
- MQTT provides the communication channel for commands and plugin management.
Researchers identified multiple C2 domains and infrastructure associated with the campaign. Some infrastructure reportedly used Cloudflare as a proxy, making attribution and infrastructure tracking more difficult.
Potential Risks & Impact
Data Collection Risk
BambooToken Malware can collect extensive information about compromised systems. Security-product information may help attackers understand the defensive tools installed on a victim’s network.
The broader targeting described by researchers also creates potential exposure involving organizations operating mobile applications, financial services, hospitality systems, healthcare-related businesses and technology infrastructure.
Business Risk
Compromised servers can provide attackers with visibility into organizational environments and potentially create opportunities for additional malicious activity. The campaign’s multi-platform capability increases the relevance of the threat for organizations operating both Windows and Linux infrastructure.
Security and Compliance Risk
Organizations that experience malware infections may need to investigate affected systems, review authentication activity and determine whether sensitive information was accessed or transmitted. The appropriate response will depend on the systems involved and applicable regulatory requirements.
Official Response / Statement
Black Lotus Labs disclosed its findings on BambooToken and described the malware’s use of MQTT, DLL sideloading and host-information collection. The researchers also reported identifying compromised entities across several countries.
No attribution to a specific threat actor has been confirmed. The initial access vector also remains unknown based on the available information. The findings were detailed in Lumen Black Lotus Labs’ research on the BambooToken campaign, which provides additional technical information about the malware and its infrastructure.
Industry Context: Why MQTT Abuse Matters
MQTT is a legitimate lightweight publish-subscribe protocol commonly associated with IoT and connected systems. Its use as a malware C2 mechanism is not new, but it remains relatively uncommon compared with more traditional communication channels.
Previously documented malware has also abused MQTT. These examples include MQsTTang, Tizi, WailingCrab and IOCONTROL. BambooToken Malware adds another example of how legitimate communication protocols can be repurposed for malicious operations.
Organizations can follow CyberNexora News’ latest cybersecurity incident coverage to track similar developments and emerging attack techniques.
How to Protect Yourself / Your Organization
- Monitor unusual DLL activity: Investigate unexpected DLL loading by legitimate applications, particularly security or authentication software.
- Review PowerShell activity: Log and investigate suspicious PowerShell execution, especially when scripts allocate memory or launch unfamiliar binaries.
- Monitor MQTT traffic: Identify unexpected MQTT connections from servers, workstations and other systems that do not normally require the protocol.
- Strengthen endpoint monitoring: Use EDR and application-control technologies to detect suspicious process, DLL and network behavior.
- Audit security software: Investigate unexpected attempts to enumerate installed antivirus or endpoint-security products.
- Patch legitimate software: Keep authentication tools, operating systems and third-party applications updated.
- Restrict outbound connections: Apply network controls that limit unnecessary communication between internal systems and external infrastructure.
- Investigate suspicious servers: Review Linux and Windows servers for unusual processes, scheduled tasks, network connections and recently introduced files.
Organizations can also use CyberNexora’s Learn & Protect resources for additional cybersecurity awareness and defensive guidance.
Indicators of Compromise (IoCs)
Reported infrastructure associated with the campaign includes:
chat5188[.]tkapi80[.]c2iznja[.]com- Rogue DLL:
OnKeyToken_KEB.dll - MQTT-based C2 communication
- Tendyron OnKey/OnKeySrv-related DLL sideloading activity
- SoftEther VPN infrastructure associated with observed C2 communication
These indicators should be investigated alongside behavioral evidence rather than treated as standalone proof of compromise.
Key Takeaways
- BambooToken Malware targets both Windows and Linux environments.
- The malware uses MQTT for C2 communication.
- Attackers reportedly use DLL sideloading involving Tendyron OnKey software.
- BambooToken Malware can collect host and antivirus information.
- The operators remain unidentified, although researchers have described indicators suggesting a possible China nexus.
- Organizations should monitor unusual MQTT traffic and suspicious DLL-loading behavior.
Conclusion: BambooToken Malware and What Happens Next
BambooToken Malware highlights the continuing evolution of malware campaigns that abuse legitimate software and network protocols. Its combination of MQTT communication, DLL sideloading and system reconnaissance demonstrates why organizations need behavioral monitoring alongside traditional signature-based defenses.
Security teams should watch for new BambooToken Malware variants, additional C2 infrastructure and evidence of expanded targeting. Monitoring unexpected MQTT connections and unusual DLL activity can help organizations identify suspicious behavior earlier. Further updates can be followed through CyberNexora News’ cyber incident coverage.
Frequently Asked Questions (FAQs)
BambooToken Malware is a multi-platform malware campaign targeting Windows and Linux systems. It uses MQTT as a command-and-control channel and has been associated with system-information collection and DLL sideloading.
BambooToken uses MQTT to communicate with attacker-controlled C2 infrastructure. The server can send instructions related to plugin management, malware termination and other actions.
DLL sideloading occurs when a legitimate application loads a malicious DLL placed where the application can find it. Researchers reported that BambooToken used a rogue OnKeyToken_KEB.dll alongside Tendyron OnKey software.
BambooToken has been observed targeting both Windows and Linux systems. Linux targeting was reported as an expansion of the campaign by December 2025.
The threat actor behind BambooToken has not been identified. Researchers have described indicators suggesting a possible China nexus, but this remains an assessment rather than confirmed attribution.
Organizations can monitor unusual MQTT connections, suspicious DLL loading, unexpected PowerShell activity and attempts to enumerate installed security products. Endpoint and network telemetry can help correlate these behaviors.