Full Report
Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America.
Analysis Summary
# Tool/Technique: BambooToken
## Overview
BambooToken is a multi-platform malware family (targeting Windows and Linux) that utilizes the **MQTT (Message Queuing Telemetry Transport)** protocol for its Command and Control (C2) communication. Active since at least February 2023, it is primarily used for espionage, system enumeration, and data exfiltration targeting organizations in Asia and South America. The malware is notable for its use of DLL sideloading via legitimate high-security authentication software.
## Technical Details
- **Type:** Malware family
- **Platform:** Windows, Linux
- **Capabilities:** System enumeration, plugin loading, AV detection, C2 via MQTT, DLL sideloading.
- **First Seen:** February 2023 (Active through July 2026)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1574.002 - Hijack Execution Flow: DLL Side-Loading** (Using Tendyron OnKey software)
- **TA0007 - Discovery**
- **T1082 - System Information Discovery**
- **T1518.001 - Software Discovery: Security Software** (Via WMI framework)
- **TA0011 - Command and Control**
- **T1071.004 - Application Layer Protocol: DNS/Message Bus** (Use of MQTT)
- **T1090 - Proxy** (Use of Cloudflare for C2 infrastructure)
## Functionality
### Core Capabilities
- **Information Gathering:** Collects extensive host details, including system specifications and identity information.
- **MQTT Communication:** Uses the lightweight publish-subscribe protocol to receive commands, allowing it to blend in with IoT-related traffic.
- **Command Loop:** Executes server-issued instructions to load additional plugins, stop execution, or disconnect from the C2.
- **Persistence/Execution:** Leverages a DLL sideloading vulnerability in the legitimate **Tendyron "OnKey"** security token software (`OnKeyToken_KEB.dll`).
### Advanced Features
- **AV Plugin:** A specific module for Windows that uses Windows Management Instrumentation (WMI) to identify installed security products and exfiltrate their status to the C2.
- **Multi-Platform Support:** While initially Windows-based, the malware evolved into a Linux-compatible version by late 2025.
- **Infrastructure Proxying:** Utilizes Cloudflare as a proxy to mask the true location of its C2 servers.
## Indicators of Compromise
- **File Names:**
- `OnKeyToken_KEB.dll` (Malicious DLL)
- `OnKeySrv.exe` (Legitimate host for sideloading)
- **Network Indicators:**
- `chat5188[.]tk` (Older C2)
- `api80[.]c2iznja[.]com` (2025/2026 C2)
- **Behavioral Indicators:**
- Unexpected MQTT traffic (typically TCP ports 1883 or 8883) from standard workstations or Linux servers.
- `WMI` queries targeting `AntivirusProduct` classes.
## Associated Threat Actors
- **Unknown:** While specific attribution is not finalized, the activity shows overlap with Chinese IP space and tactics similar to groups like **Mustang Panda** (who also use MQTT-based backdoors like MQsTTang).
## Detection Methods
- **Behavioral Detection:** Monitor for legitimate signed binaries (like Tendyron software) loading unsigned or unexpected DLLs from the local directory.
- **Network Monitoring:** Inspect outbound traffic for MQTT protocol usage from non-IoT devices.
- **Host Discovery:** Use EDR to flag WMI queries specifically looking for security software configurations.
## Mitigation Strategies
- **DLL Sideloading Prevention:** Implement "Secure DLL Search Order" and monitor directories where high-security software (like PKI token managers) is installed.
- **Network Segmentation:** Restrict the MQTT protocol at the firewall level to only authorized IoT gateways or known brokers.
- **Software Auditing:** Audit the use of Tendyron OnKey software; ensure the application and its dependencies are monitored for unauthorized modifications.
## Related Tools/Techniques
- **MQsTTang:** A backdoor used by Mustang Panda that also utilizes MQTT.
- **WailingCrab (WikiLoader):** Another malware family utilizing MQTT for C2 communications.
- **IOCONTROL:** OT-focused malware using MQTT to target SCADA systems.