BambooToken moves its Windows and Linux command channel onto MQTT brokers

Each infected host subscribes to MQTT topics keyed to a unique identifier, and the operator publishes the commands to be run into those topics ^[4]. The host publishes status and system information back through the same broker and takes its instructions from the topics it subscribes to ^[5]. MQTT is a lightweight protocol built for IoT devices, and it relays messages through a central broker instead of a direct channel between the two ends ^[3]. The victim therefore never connects to attacker-owned infrastructure, and Black Lotus Labs credits that indirection for the malware's evasion and resilience; the traffic is asynchronous, so a command waits in the topic through a temporary network outage ^[6].

BambooToken is not the first MQTT backdoor. ESET published on an unrelated MQTT backdoor called MQsTTang in 2023 ^[18], before the BambooToken variants that moved to MQTT were built in 2024 and 2025 ^[2][19]. A server running a mobile application backend has no obvious reason to speak an IoT telemetry protocol outbound ^[3][13]. The case for the protocol as a gap rests on the broker sitting in the middle; Lumen did not measure how widely enterprises inspect or block MQTT ^[22].

The victim list runs to hotels, biomedical firms, law firms, a financial organization and a cryptocurrency website in Lithuania ^[12]. Measured against a run from 2023 to the December 2025 Linux sample ^[1][10], a dozen entities is roughly five a year in the visibility Lumen has ^[21]. Black Lotus Labs also found a compromised GitLab server in Hong Kong, and calls it a potential foothold for supply-chain attacks ^[14].

The capability inventory is thinner than the strings suggest. The one plugin the researchers recovered enumerates antivirus products on the host and returns the results to the C2 ^[8]. Keylogging, clipboard theft, audio recording, webcam capture and screenshot capture appear only as strings in dead code, and the researchers say they cannot tell whether those modules existed and were used or were still being written ^[9]. Of the newest build, Black Lotus Labs said "the Linux sample still appeared to be under development" ^[11].

Lumen hypothesizes that some of the activity targeted overseas Chinese users reaching mainland services through the SpeedCN VPN service ^[15]. The researchers could not attribute the activity to a specific threat actor or a known cluster, and say the targeting patterns are consistent with China-aligned operations ^[16]. Indicators of compromise for the campaign are published ^[17].