"the Linux sample still appeared to be under development," Black Lotus Labs reported — a single line that captures both the active reach and the unfinished edges of a novel malware framework now weaponizing an IoT messaging protocol against servers running Windows and Linux.
MQTT as a command-and-control channel
BambooToken, a previously unknown malware framework active since at least 2023, adopted the Message Queuing Telemetry Transport (MQTT) protocol for its command-and-control (C2) communications in variants developed between 2024 and 2025, according to a report from Lumen's Black Lotus Labs. MQTT is a lightweight messaging protocol designed for Internet of Things devices that relies on a central broker and publish/subscribe topics rather than direct host-to-host connections.
In BambooToken's implementation, infected machines subscribe to topics tied to a unique identifier. Operators publish commands to those topics; the infected host publishes status and system information back through the broker. Black Lotus Labs highlighted two operational advantages of this design: infected systems do not connect directly to attacker infrastructure — which increases evasion and resilience — and communications can be asynchronous, preserving continuity across temporary network disruptions.
Infection vectors and a supply-chain foothold
Black Lotus Labs traced initial compromise methods to side-loading of a digitally signed Tendyron OnKey USB-token software and to binaries impersonating the Kingsoft Office productivity suite. The researchers also identified a compromised GitLab server in Hong Kong, which they warned could provide a foothold for supply-chain attacks.
The report found that the most heavily impacted servers were linked to the backend infrastructure of mobile applications, an observation that underscores how developer-facing servers and CI/CD systems can amplify an intrusion into downstream software ecosystems.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageCapabilities observed, and the problem of "dead code"
Black Lotus Labs recovered a BambooToken plugin that enumerates installed antivirus products and returns the results to the C2. The researchers also found strings within samples that refer to keylogging, clipboard theft, audio recording, webcam capture, and screenshot capture. Crucially, Black Lotus Labs described those references as coming from "dead code," meaning the team could not confidently determine whether those modules were present in deployed attacks or were still under development.
The Linux variant the researchers linked to the campaign — BambooToken version 2.1, observed in December 2025 — likewise used MQTT, collected extensive system information, could spawn a command shell, and allowed operators to upload, download, and delete files. Again, Black Lotus Labs cautioned that the Linux sample still appeared to be under development.
Targets, geography, and targeting signals
Lumen's telemetry identified roughly a dozen compromised enterprise entities, predominantly in Asia and South America. Affected organizations included hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency website in Lithuania. The researchers also hypothesized that some activity may have targeted overseas Chinese users accessing mainland services through the SpeedCN VPN service.
Though the report did not attribute BambooToken to a named actor or a known activity cluster, Black Lotus Labs noted that the targeting patterns were consistent with China-aligned operations. Lumen has shared indicators of compromise (IoCs) to help defenders detect and block the activity.
What this means for technologists, procurement leaders, and affected enterprises
- Technologists and security teams: Monitor MQTT traffic and broker access patterns, especially for servers supporting mobile-app backends and development infrastructure. The publish/subscribe model used by BambooToken changes detection surface areas away from simple outbound connections to attacker servers.
- Procurement and IT buyers: Verify the provenance and signing of components like USB-token software and developer tooling; side-loading of signed installers was one observed vector. The GitLab compromise in Hong Kong highlights risk to source and build systems.
- Affected enterprises (hotels, law firms, biomedical firms, financial organizations, and crypto platforms): Review server exposures and the integrity of backend APIs and app backends; Lumen's listing of IoCs is a concrete artifact teams can ingest into detection systems.
Two threads run through the report: developers' servers and mobile backends amplify impact, and MQTT provides an opportune conduit for stealthy, asynchronous command and control. Black Lotus Labs furnished IoCs for defenders; what remains unsettled is attribution — the researchers explicitly did not link BambooToken to a named group even while flagging targeting consistent with China-aligned operations.
The immediate, actionable step in the report is unambiguous: use the IoCs Lumen provided and treat MQTT broker traffic as a potential C2 vector where BambooToken-style publish/subscribe patterns could hide. Beyond that, the discovery raises a narrower but sharper question — how many other frameworks will adopt IoT protocols to avoid traditional network-based detection, and who will find them first?
