BambooToken: Three Years of Hidden MQTT C2 Inside Enterprise Networks

On September 18, 2026, Lumen Black Lotus Labs disclosed BambooToken, a malware campaign active since February 2023 that remained undetected for over three and a half years. The operation compromised approximately twelve organizations in Asia and South America — hotels, biomedical firms, law practices, financial services, cryptocurrency platforms, and mobile-app backends — by exploiting two techniques that bypassed defenses: the MQTT protocol for asynchronous command-and-control and DLL sideloading through a legitimate digitally signed executable.

How MQTT Became the C2 Channel

The choice of the MQTT (Message Queuing Telemetry Transport) protocol is deliberate. Designed for the Internet of Things and Industry 4.0, MQTT is lightweight, asynchronous, and resilient to disconnections — traits that suit distributed sensor infrastructures but also serve a command-and-control infrastructure that must stay invisible.

According to Lumen research cited by The Hacker News, MQTT adoption in BambooToken variants occurred between 2024 and 2025, marking an evolution in the campaign. The MQTT brokers used as relays allowed the threat actor to control numerous clients from a central point, with traffic masked through Cloudflare. This architecture does not require persistent direct connections between the compromised machine and the attacker's server: commands and responses transit via MQTT topics, a publish/subscribe model that does not resemble the web or DNS traffic typically monitored by security teams.

The result is a structural visibility gap. In enterprise organizations, MQTT traffic monitoring is often delegated to OT/IoT teams or simply absent because the protocol is perceived as foreign to traditional IT systems. BambooToken demonstrates that this separation is exploitable: enterprise malware can hide its C2 in a channel that SOCs do not watch.

DLL Sideloading and the Trust of Signed Software

For execution on Windows, BambooToken does not rely on zero-day exploits or complex injection techniques. Instead, it uses DLL sideloading through OnKeySrv.exe, a component of the Tendyron OnKey software, a PKI USB token widely deployed in China for cryptographic authentication. The legitimate executable loads a malicious library renamed OnKeyToken_KEB.dll, achieving execution in the context of a digitally signed process.

As Ryan English, information security engineer at Lumen Technologies Black Lotus Labs, told The Hacker News: "The first version of BambooToken was initiated via a PowerShell script... We assess that sideloading would likely trigger fewer EDR alerts, so as the campaign evolved so did that threat actors TTPs." The quote reflects an internal Lumen assessment: the shift from PowerShell to sideloading represents an operational choice to reduce visibility in endpoint detection systems.

The source explicitly states there was no compromise of Tendyron's code-signing certificate or build environment. The software is authentic; its library-loading mechanism is being abused. This distinguishes the case from a traditional supply-chain attack and places it in a category of techniques that exploit the implicit trust assigned by the operating system and EDRs to signed binaries.

Cross-Platform Modularity and the Linux Sample

BambooToken is not limited to Windows. According to BleepingComputer, Lumen observed a BambooToken v2.1 Linux sample in December 2025. The Linux sample, however, still appeared to be in development: the direct quote from Lumen reported by the same source is "the Linux sample still appeared to be under development."

This duality is significant. The ability to operate on both platforms indicates an intent for lateral movement within heterogeneous networks, where Linux servers manage critical infrastructure and Windows clients host human operators. The modularity observed in variants — plugins for antivirus enumeration via WMI on Windows, code potentially destined for surveillance capabilities on both platforms — suggests an architecture designed to be extended for specific objectives.

BleepingComputer notes strings in dead code indicating potential capabilities: keylogging, clipboard theft, audio recording, webcam capture, and screenshots. However, the dossier does not allow verification of whether these functions were actually activated in the detected intrusions. They are indicators of capability, not proof of operational use.

GitLab Server in Hong Kong and Supply-Chain Risk

Among the documented compromises, Lumen highlighted a GitLab server in Hong Kong. All three primary sources cite it as a particularly relevant case for potential supply-chain risk in DevOps tooling. The dossier does not establish that the server was used to distribute malicious code downstream, but the exposure profile — source-code repositories in a geographically sensitive region — places the incident in a risk category that extends beyond the single compromised organization.

Operator identity remains partially obscure. The China-nexus attribution rests on two converging technical indicators: the DLL sideloading pattern associated with China-oriented intrusion sets, and a SoftEther VPN connection from a VPS to a command-and-control node. Lumen explicitly avoided naming a specific APT group, and the dossier does not document infrastructure overlaps with attributed campaigns such as MQsTTang or Mustang Panda, although these parallels have been raised as unproven hypotheses.

What to Do Now

Lumen's disclosure does not include a structured advisory with CVEs or patches, but the published evidence points to priority actions for organizations managing networks with MQTT exposure or using PKI authentication software.

• Check for unauthorized MQTT traffic to external brokers, including those proxied via Cloudflare, and extend protocol monitoring to IT segments traditionally excluded from OT/IoT surveillance.
• Inspect Tendyron OnKey installations for anomalous DLLs in the same directory as OnKeySrv.exe, with particular attention to OnKeyToken_KEB.dll that does not match the vendor's official signature.
• Review EDR trust policies for signed processes: DLL sideloading by legitimate executables can evade detection based solely on signature reputation.
• Audit access to internal and external GitLab servers, with particular attention to instances in high-risk geographic regions, verifying for anomalous access or unauthorized repository modifications.

"Using MQTT to control numerous clients from a central point, combined with routing via Cloudflare, enables large-scale operation through an unconventional communication method" — Lumen Black Lotus Labs, reported by The Hacker News

The Forgotten Protocol That Wasn't

BambooToken is not the only malware to exploit MQTT: the dossier cites previous campaigns such as MQsTTang (2023), Tizi, WailingCrab, and IOCONTROL. The difference lies in the duration and the ability to persist undetected. Three and a half years of activity with a protocol considered of secondary importance for enterprise security indicates a systemic failure in risk segmentation, not an individual technical flaw.

The case raises a broader question: lightweight protocols conceived for IoT are becoming the substrate for C2 infrastructures that defenders do not scrutinize enough. The next campaign could use CoAP, AMQP, or another industrial standard. The lesson of BambooToken is that invisibility does not stem from cryptographic sophistication, but from an architectural choice that exploits the boundaries between organizational competencies.

Frequently Asked Questions

Was Tendyron's certificate stolen?

No. According to the cited sources, there was no compromise of the code-signing certificate or the build environment. The malware exploits the legitimate DLL loading by a signed executable, not signature forgery.

Why is MQTT hard to detect as C2?

MQTT uses a publish/subscribe model via intermediate brokers, not direct point-to-point connections. Traffic can be fragmented, asynchronous, and routed through legitimate infrastructure such as Cloudflare, reducing the signatures detectable by traditional security systems.

Is the Linux sample operational?

According to the direct quote from Lumen reported by BleepingComputer, the Linux sample observed in December 2025 "still appeared to be under development." Cross-platform capability is documented, but operational maturity differs from the Windows variant.

Sources

• https://tech-insider.org/bambootoken-malware-mqtt-dll-sideloading-2026/
• https://www.bleepingcomputer.com/news/security/bambootoken-malware-controls-windows-and-linux-systems-via-mqtt/
• https://thehackernews.com/2026/09/bambootoken-malware-uses-mqtt-to.html
• https://www.bleepingcomputer.com/
• https://www.bleepingcomputer.com/tutorials/
• https://www.bleepingcomputer.com/download/
• https://deals.bleepingcomputer.com/