China-Aligned Cyber Operations

BambooToken moves its Windows and Linux command channel onto MQTT brokers

Black Lotus Labs counted about a dozen compromised enterprises, mostly in Asia and South America, on a framework that has been publishing operator commands to infected hosts through IoT message brokers since 2024.