Researchers at Black Lotus Labs, the research division of Lumen, have documented BambooToken, a previously undisclosed malware framework that has been operating since at least 2023. The threat has evolved to employ the Message Queuing Telemetry Transport (MQTT) protocol for command-and-control operations in recent variants discovered between 2024 and 2025, affecting both Windows and Linux systems across mobile app backends, legal services, financial institutions, and software development operations.
MQTT is a lightweight publish-subscribe messaging protocol originally built for Internet of Things deployments. Rather than establishing direct communication channels, the protocol relies on a central broker and topic-based message routing, allowing publishers to send data to subscribers listening on specific channels. While not a novel technology, its adoption for malware command-and-control remains uncommon; ESET documented a separate MQTT-based backdoor called MQsTTang in 2023.
Operational advantages through indirect communication
BambooToken's implementation assigns each compromised machine a unique identifier and subscribes it to corresponding MQTT topics. The attacker publishes execution commands through these topics while the malware relays system status and information back through the broker. This architecture provides significant operational benefits: infected systems maintain no direct connections to attacker infrastructure, enhancing both evasion capabilities and resilience. Asynchronous messaging also enables continued operations during temporary network outages.
Infection vectors and capabilities
Black Lotus Labs identified two primary infection mechanisms. The malware spreads through side-loading attacks against digitally signed Tendyron OnKey USB-token software or by masquerading as Kingsoft Office productivity applications. Researchers recovered a BambooToken plugin designed to enumerate antivirus products on infected systems and transmit findings to the command-and-control infrastructure.
Analysis revealed code strings referencing keylogging, clipboard interception, audio capture, webcam recording, and screenshot functionality. However, Black Lotus Labs emphasized that these capabilities were discovered in "dead code," preventing researchers from definitively confirming whether these modules were actively deployed in attacks or remained under development.
Linux variant and current status
The most recent identified variant, BambooToken version 2.1 for Linux, was observed in December 2025. This version also implements MQTT for communications, gathers comprehensive system information, can instantiate command shells, and permits operators to upload, download, and remove files. Black Lotus Labs noted that "the Linux sample still appeared to be under development."
Targeting and geographic scope
Lumen's telemetry tracked approximately a dozen compromised enterprise entities, predominantly located in Asia and South America. Affected organizations span hotels, biomedical companies, law practices, financial services providers, and a cryptocurrency platform based in Lithuania. The most frequently compromised infrastructure supported backend systems for mobile applications.
Researchers also discovered a compromised GitLab instance in Hong Kong, which could serve as a staging point for supply-chain attacks. Analysis suggests certain activity may have targeted overseas Chinese users connecting to mainland services via the SpeedCN VPN service.
While Black Lotus Labs could not attribute BambooToken to a specific threat actor or established activity group, the targeting patterns align with operations associated with China-based threat actors. The organization has published indicators of compromise to support defenders in identifying and blocking related attacks.