framework

BambooToken

Modular malware framework for Windows and Linux that carries operator commands over MQTT message brokers, publicly documented by Lumen's Black Lotus Labs.

Known aliases

BambooToken 2.1

Relationships

No evidence-backed relationships are recorded.

Current clusters

security2 publishers

BambooToken moves its Windows and Linux command channel onto MQTT brokers

Black Lotus Labs counted about a dozen compromised enterprises, mostly in Asia and South America, on a framework that has been publishing operator commands to infected hosts through IoT message brokers since 2024.

Publishers:bleepingcomputer.comthehackernews.com

Reality

Evidence52
Adoption22
Hype gap+12
Incentives55
Confidence55