BambooToken: The Malware That Speaks an IoT Protocol to Stay Hidden

Overview

In September 2026, Lumen Black Lotus Labs published a report on BambooToken — a previously undocumented malware framework that operated undetected from February 2023 through July 2026, targeting both Windows and Linux systems.

What makes BambooToken particularly noteworthy is its command-and-control channel: instead of conventional HTTP/HTTPS, versions from 2024 onward switched to MQTT (Message Queuing Telemetry Transport) — a lightweight messaging protocol designed for IoT devices and industrial sensors, not for malware.

This choice delivers substantial operational advantages. MQTT works on a publish-subscribe model through a central broker: the infected machine subscribes to topics tied to a unique identifier, while the operator publishes commands into those same topics. The consequence: the victim machine never connects directly to the attacker's infrastructure — everything passes through the broker, completely concealing the real C2 server. MQTT's asynchronous nature also ensures communications survive network disruptions.

Black Lotus Labs identified approximately 12 compromised enterprise entities, concentrated in Asia and South America, plus a separate campaign targeting roughly 150 MikroTik and DrayTek routers across Southeast Asia.

Why MQTT Is a Concerning Choice

MQTT was designed for IoT sensor networks: lightweight, bandwidth-efficient, tolerant of poor connectivity. Those same properties serve malware exceptionally well:

MQTT property	Original design purpose	Advantage for the attacker
Publish-subscribe via a broker	Lets many sensors send/receive data through a shared hub	The victim machine never connects directly to C2 — it only talks to the broker, hiding the real infrastructure
Asynchronous communication	Sensors can go offline and receive data later	Commands are not lost during network interruptions; the implant receives queued commands when it comes back online
Topic-based routing	Routes data by subject	Each infected machine gets its own GUID-based topic → precise, independent control of individual hosts
Lightweight, common in industrial environments	Reduces load on resource-constrained devices	MQTT traffic is typically unmonitored in traditional enterprise networks

The key point for defenders: most organizations monitor outbound HTTP/HTTPS/DNS closely, but MQTT (ports 1883, 8883) usually falls outside that scope — particularly at organizations that run no IoT/OT systems. When an office endpoint suddenly opens a persistent MQTT connection to the internet, that is almost certainly anomalous — but only if the organization has alerting configured for it.

About the Threat Actor

Attribute	Detail
Framework name	BambooToken (named by Lumen Black Lotus Labs)
Active period	February 2023 – July 2026 (over 3 years)
Target platforms	Windows and Linux (multiplatform)
Attribution	No definitive attribution. Black Lotus Labs assesses this as a skilled threat actor likely aligned with People's Republic of China (PRC) interests — but claims no formal nation-state attribution
Classification status	Researchers could not correlate this framework with any publicly documented activity cluster, and label it an emerging threat cluster

Basis for the PRC-alignment assessment (per Black Lotus Labs):

Tendyron OnKey software is abused as the primary infection vector — software widely deployed in Chinese banking and government networks.
Most samples were uploaded from Chinese IP space, with C2 telemetry geolocated inside China.
Sophisticated OPSEC techniques and careful infrastructure compartmentalization.
TTPs consistent with documented PRC-aligned actors such as Volt Typhoon, GhostEmperor, and ZuoRAT.
A targeting pattern focused on "discreet locations" (Asia, South America) before potential expansion to higher-value targets — a documented PRC actor pattern.

Technical Analysis

1. Two Windows Infection Vectors

1.1. DLL Side-Loading via Tendyron "OnKey" USB Token Software

This is the primary vector, and also the most contextually concerning detail.

Tendyron manufactures hardware-based USB tokens used in high-security settings to verify user identity for workstation access — meaning the software is typically installed on precisely the machines an organization protects most carefully.

The actor abuses a file vulnerable to sideloading — likely OnKeySrv.exe — to load a malicious payload named OnKeyToken_KEB.dll.

A critical detail worth emphasizing: Black Lotus Labs assesses that neither Tendyron's code-signing certificate nor its build environment was compromised. This is not a supply-chain attack against Tendyron — the actor merely exploits a legitimate but vulnerable execution flow (Windows DLL search order), the exact same underlying principle seen in SLEEPWALKER (ESET) and MoiClient (SumatraPDF) in previous articles.

1.2. Impersonating the Kingsoft Office Productivity Suite

Another Windows variant masquerades as legitimate software from "Zhuhai Kingsoft Office Software Co., Ltd." — a productivity suite (WPS Office) widely used in China.

This malicious variant fails certificate signature validation, confirming it was not signed with legitimate credentials but merely spoofs the identity of the real application.

2. Evolution Across Three Versions

Version 1 (February 2023) — Starting With HTTP

The initial framework used HTTP for C2 communications. The agent checks for an OnKeySrv.dat file containing a malleable profile with C2 configuration. If unavailable, it falls back to hardcoded C2 addresses such as api08.chat5188.tk.

Before establishing communications, the binary gathers system information: architecture, CPU details, memory, public IP (via icanhazip.com), MAC address, and file information.

Version 2.0 (2024–2025) — The Move to MQTT

The most significant shift: transitioning all C2 communications to MQTT.

Windows variants employ hijack flow execution techniques, enumerating hosts through WMI (Windows Management Instrumentation) to collect OS information, product details, serial numbers, and licensing data.

Version 2.1 (from December 2025) — The Linux Variant

Compiled for multiplatform operations. Characteristics:

Three initialization arguments: i, p, v, with daemonization capability (running in the background as a system service).
Hardcoded C2: live-hk.c2iznja.com and an embedded GUID.
Substantially more robust host enumeration than its Windows predecessors — collecting system BIOS, MAC address, CPU, memory, process/thread IDs, and architecture specifications.

3. MQTT Architecture — Controlling Each Infected Host

The malware appears to use Eclipse Mosquitto — an open-source MQTT library — for its implementation.

Subscribed topics vary by malware version, but typically include global broadcast channels plus GUID-specific topics:

{GUID}/Plugin          — receive a new plugin
{GUID}/removePlugin    — remove a plugin
{GUID}/LUA             — execute LUA code
{GUID}/unPlugin        — unload a plugin
{GUID}/                — that host's general channel

How it works: each infected machine has a unique GUID. To command a specific host, the operator simply publishes to the topic bearing that host's GUID; to command the entire botnet, they publish to a broadcast channel. The central broker handles distribution — the attacker never connects directly to the victim machine, and vice versa.

4. The Plugin Set — What Is Deployed and What Remains Unfinished

The framework supports modular plugins:

Handler / Plugin	Capability	Status
SHELL	Spawns command shell execution threads	Deployed
FILEEX	File upload, download, deletion, and execution control	Deployed
ONLINE	Collects and transmits host-based heartbeat beacons	Deployed
Antivirus Plugin	Uses WMI queries to enumerate installed antivirus products every five seconds, transmitting results to C2 via HTTP GET	Deployed (recovered by researchers)
`KEY_RECORD`	Keylogging	Dead code — under development
`COM_clipboard`	Clipboard data exfiltration	Dead code — under development
Audio recording	Audio capture	Dead code — under development
Webcam / desktop capture	Webcam and screen capture	Dead code — under development

A notable detail: the AV enumeration plugin running every five seconds shows the actor places high priority on closely tracking the defensive environment on the victim host — very likely to decide whether to deploy the next payload, and which one.

The presence of deep surveillance capabilities (keylogging, clipboard, audio, webcam) as dead code indicates this is a framework still under active development — future variants may well activate these capabilities in full.

5. Victimology — And Three Points of Contact With Vietnam

5.1. Enterprise victims (~12 organizations)

Sector	Specific victims
Software development	A GitLab instance in Hong Kong (potential supply-chain attack vector); a Vietnamese portable device manufacturer
Hospitality	A Vietnamese hotel
Financial services	A Malaysian finance organization
Legal services	A Chilean law firm
Biomedical	An Argentine company
Cryptocurrency	A Lithuania-based crypto website
Mobile app backend servers	Cryptocurrency, chat, leisure/entertainment, lifestyle/wellness applications

Geographic distribution: predominantly Asia-Pacific (Singapore, Cambodia, Vietnam, Hong Kong, Malaysia), with secondary targeting in South America (Argentina, Chile).

5.2. Small-network infrastructure campaign — ~150 routers

Running alongside the enterprise campaign, Black Lotus Labs documented a separate operation targeting approximately 150 MikroTik and DrayTek routers across Southeast Asia — geolocated to Singapore, Cambodia, and Vietnam — with persistent MQTT connections to C2 node 202.144.192.149.

Why are routers attractive targets? Edge routers typically: (1) have no EDR, (2) are rarely patched, (3) run 24/7, and (4) see all traffic from the network behind them. This is a pattern seen in other PRC-nexus campaigns (Volt Typhoon, ZuoRAT) — using edge devices as operational relay boxes (ORBs) or springboards into internal networks.

5.3. The SpeedCN VPN angle — targeting the overseas Chinese community

The report identifies "SpeedCN" — described as a VPN service for overseas Chinese users, allowing them to access Chinese websites without regional restrictions.

The threat actor leveraged this service for command infrastructure, with UDP-based connections from compromised routers terminating at VPN endpoints inside mainland China.

Researchers hypothesize this targeting focuses on the diaspora — people physically located outside China who remain connected to the mainland ecosystem.

6. Infrastructure and Timeline

Active period: February 2023 → July 2026

Phase	C2 domain	Notes
Historical	`chat5188.tk`	Peak operations December 17, 2024; reached top 1 million in Cloudflare Radar rankings
Current	`c2iznja.com`	Reached top 500,000 domains by December 28, 2025

Notable subdomains: api80.c2iznja.com, live-hk.c2iznja.com, turbo.c2iznja.com, base64.c2iznja.com

Infrastructure transition: Two IP addresses — 210.1.231.13 and 202.144.192.149 — appear across both historical and current domains, indicating a coordinated migration of infected devices from deprecated to newer C2 infrastructure.

Cloudflare proxy abuse: Multiple domains are hidden behind the Cloudflare CDN (cache.c2iznja.com, apis.chat5188.tk, chat.chat5188.tk) — obscuring the true origin infrastructure.

Observation: a C2 domain reaching the top 500,000–1 million in Cloudflare Radar rankings is a notable quantitative indicator of scale — this is not the traffic profile of a small, isolated campaign.

Risk Summary

Risk Dimension	Level	Rationale
Stealth	Very High	MQTT falls outside most organizations' monitoring scope; victim machines never connect directly to C2
Undetected dwell time	Critical	Operated for over three years (Feb 2023 – Jul 2026) before public disclosure
Infrastructure resilience	High	Broker architecture + Cloudflare proxy + coordinated infrastructure migration
Platform reach	High	Both Windows and Linux; plus MikroTik/DrayTek routers
Escalation potential	High	Keylogging, clipboard, audio, and webcam capture already present as dead code — awaiting activation
Supply-chain risk	High	A compromised GitLab instance; a targeted device manufacturer — both springboards for downstream attacks
Relevance to Vietnam	High	Two Vietnamese businesses compromised + Vietnamese routers in the botnet

IOCs & Artifacts

C2 IP Addresses

IP	ASN / Country	Observed ports
`202.144.192.23`	ASN 63916, Japan	1883/2883 (MQTT), 63196 (SSH)
`202.144.192.149`	ASN 63916, Japan	1883/2883 (MQTT), 8883 (SSL MQTT), 63916 (SSH)
`210.1.226.238`	—	8883 (SSL MQTT), 63196 (SSH)
`210.1.226.163`	—	63916 (SSH)
`210.1.231.13`	ASN 45785, Malaysia	443/1883 (MQTT), 63916 (SSH), 64332 (staging)
`43.245.198.195`	—	1883 (MQTT), 63196 (SSH)
`43.245.198.238`	—	1883 (MQTT), 63196 (SSH)

Domains

c2iznja.com               (current C2 domain)
  ├─ api80.c2iznja.com
  ├─ live-hk.c2iznja.com   (hardcoded C2 for the Linux v2.1 variant)
  ├─ turbo.c2iznja.com
  ├─ base64.c2iznja.com
  └─ cache.c2iznja.com     (behind Cloudflare)

chat5188.tk               (historical C2 domain)
  ├─ api08.chat5188.tk     (hardcoded C2 for version 1)
  ├─ apis.chat5188.tk      (behind Cloudflare)
  └─ chat.chat5188.tk      (behind Cloudflare)

MQTT Topics (detection patterns)

{GUID}/Plugin
{GUID}/removePlugin
{GUID}/LUA
{GUID}/unPlugin
{GUID}/
+ global broadcast topics

File Artifacts

Filename	Role
`OnKeySrv.exe`	Legitimate Tendyron binary abused for side-loading
`OnKeyToken_KEB.dll`	Malicious DLL that is side-loaded
`OnKeySrv.dat`	Config file containing the malleable profile with C2 details (version 1)

Sample Hash (cited in the report)

SHA-256: dffa94a0f9c4dc38d475a32741f7f134cc934c7b98bec581c135da1b5aa1983f

X.509 Certificate Fingerprint

SHA-256: 44e3580d84ba7534e815ae9c12c4165fbc9313adc7475808908fec26e9b17f19

The complete IOC list (all sample hashes and certificate fingerprints) is in the Indicators section of the original Black Lotus Labs report — see References.

Behavioral Indicators

Persistent outbound MQTT connections from endpoints or servers with no legitimate IoT/OT requirement — especially ports 1883 (plaintext MQTT), 2883, and 8883 (MQTT over SSL).
WMI queries enumerating AV products repeating every five seconds — a highly distinctive pattern rarely seen in legitimate software.
Requests to icanhazip.com from an unrecognized process (version 1 used this to obtain the public IP).
OnKeyToken_KEB.dll or OnKeySrv.dat appearing in unusual locations alongside OnKeySrv.exe.
Daemonized Linux processes launched with the initialization arguments i, p, v.
MikroTik/DrayTek routers maintaining outbound MQTT connections — almost certainly anomalous for ordinary edge devices.

MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Description in Campaign
Resource Development	T1583.001	Acquire Infrastructure: Domains	`chat5188.tk` → `c2iznja.com`, coordinated infrastructure migration
Resource Development	T1584.005	Compromise Infrastructure: Botnet	~150 MikroTik/DrayTek routers under control across Southeast Asia
Execution	T1129	Shared Modules	Modular plugin architecture (SHELL, FILEEX, ONLINE, Antivirus)
Persistence / Defense Evasion	T1574.002	Hijack Execution Flow: DLL Side-Loading	Abusing Tendyron's `OnKeySrv.exe` to load `OnKeyToken_KEB.dll`
Defense Evasion	T1036.005	Masquerading: Match Legitimate Name or Location	Variant impersonating Kingsoft Office (Zhuhai Kingsoft)
Defense Evasion	T1518.001	Software Discovery: Security Software Discovery	Plugin enumerating AV products every five seconds via WMI
Defense Evasion	T1027	Obfuscated Files or Information	Malleable profile within `OnKeySrv.dat`
Discovery	T1082	System Information Discovery	Collects architecture, CPU, memory, BIOS, MAC, process/thread IDs
Discovery	T1016	System Network Configuration Discovery	Obtains public IP via `icanhazip.com`, MAC address
Discovery	T1047	Windows Management Instrumentation	Enumerates OS, serial, licensing data via WMI
Command and Control	T1071	Application Layer Protocol	MQTT as the primary C2 protocol (v2.0+); HTTP in v1
Command and Control	T1102	Web Service	Cloudflare CDN concealing origin C2 infrastructure
Command and Control	T1090	Proxy	MQTT broker architecture + SpeedCN VPN as intermediary layers
Command and Control	T1573	Encrypted Channel	MQTT over SSL (port 8883)
Collection	T1056.001	Input Capture: Keylogging	`KEY_RECORD` — dead code, under development
Collection	T1115	Clipboard Data	`COM_clipboard` — dead code, under development
Collection	T1123 / T1125 / T1113	Audio Capture / Video Capture / Screen Capture	Dead code, under development
Exfiltration	T1041	Exfiltration Over C2 Channel	AV enumeration results sent to C2 via HTTP GET

Expert Assessment

The biggest lesson from BambooToken is not a new technique, but a question about monitoring scope. MQTT is not a secret or technically evasive protocol — it is an open standard, fully documented, and extremely common in industrial settings. It works for attackers only because most organizations never think to monitor it. This is a form of "hiding by standing where nobody looks" — and it worked for more than three years.

This raises a practical question for every security team: what is on your organization's list of protocols actually monitored on egress? If the answer is "HTTP, HTTPS, DNS, and maybe SMB" — a very wide surface is left uncovered. MQTT is only one example; AMQP, CoAP, and other IoT/messaging protocols share the same attacker-friendly properties. Notably, earlier articles in this series documented RabbitMQ/AMQP in GigaWiper and Redis in that same campaign — this is not an isolated phenomenon but a clear trend: shifting C2 onto legitimate messaging protocols.

The abuse of Tendyron OnKey carries an irony worth reflecting on. That software exists to verify user identity in high-security environments — meaning it is installed on precisely the machines an organization trusts most and protects most carefully. The attacker did not break Tendyron's security mechanism; they simply borrowed its legitimate execution flow. A critical point to emphasize: Tendyron's code-signing certificate and build environment were not compromised — this is not a supply-chain attack on the vendor, but exploitation of the Windows DLL search order, the same principle as SLEEPWALKER (ESET) and MoiClient (SumatraPDF). Three incidents, three different products, one shared underlying mechanism — indicating a systemic attack surface rather than any single vendor's failure.

On the dead code, read it for what it actually means. That keylogging, clipboard theft, audio recording, and webcam capture exist but are not yet deployed does not mean the threat is lower — it means this framework is still being actively invested in. An actor that has sustained operations for three years without detection, and is still expanding its capabilities, is an actor with long-term plans. Public disclosure may force infrastructure changes — but the framework will very likely persist in a new form.

For Vietnam, this is a specific warning at three distinct layers — and that is precisely what makes it concerning:

First, the enterprise layer: a portable device manufacturer and a hotel in Vietnam are among the ~12 compromised organizations. The device manufacturer is particularly notable — combined with the compromised GitLab instance in Hong Kong, the pattern suggests clear interest in supply-chain springboards across the region.

Second, the network infrastructure layer: Vietnam is one of three countries with MikroTik/DrayTek routers under attacker control. These are exactly the devices very widely used by Vietnamese SMEs but rarely patched, rarely rotated off default credentials, and almost never monitored.

Third, the sector layer: hotels are a classic espionage target — guest data, itineraries, and shared Wi-Fi networks are valuable sources for tracking specific individuals. A Vietnamese hotel being targeted is unlikely to be incidental.

Recommendations

Network monitoring — highest priority

Configure alerting for outbound MQTT traffic at the perimeter firewall: ports 1883 (plaintext MQTT), 2883, and 8883 (MQTT over SSL). For most enterprises that run no IoT/OT systems, any outbound MQTT connection warrants investigation.
Expand the catalogue of monitored protocols beyond HTTP/HTTPS/DNS — to include MQTT, AMQP, and other messaging protocols. Black Lotus Labs specifically recommends implementing centralized firewall rules to detect anomalous protocols traversing network boundaries.
Block all published IOCs (the 7 C2 IPs and the c2iznja.com / chat5188.tk domains and subdomains) at firewall, proxy, and DNS layers.
Monitor large data transfer events, alerting even when the destination is geographically nearby — a specific Black Lotus Labs recommendation, since most victims and C2 infrastructure sit within the same region.

Router and edge device protection

Patch and harden routers immediately — especially MikroTik and DrayTek devices in Vietnam, Singapore, and Cambodia. This is a direct recommendation from the original report.
Replace all default credentials and harden SNMP configuration.
Check whether routers maintain outbound MQTT connections — for ordinary enterprise routers, this is almost certainly a compromise indicator.
For organizations lacking the resources to manage edge devices, consider outsourced management — also recommended in the report.

Endpoint detection

Hunt for OnKeyToken_KEB.dll and OnKeySrv.* files in unusual locations — particularly at organizations that have deployed Tendyron USB tokens.
Alert on repeated WMI queries enumerating AV products at high frequency (every five seconds) — a highly distinctive BambooToken plugin signature.
Review Linux daemon processes launched with unrecognized i, p, v initialization arguments.
Deploy centralized EDR with routine signature updates, alongside automated detection and response services to identify lateral movement.

Supply-chain governance

Map supply-chain dependencies — maintain visibility of code dependencies and CI/CD pipeline security. The compromise of a GitLab instance in this campaign shows this is a priority target for the actor.
Separately audit machines running security token / hardware authentication software — the paradox is that these are often the most critical machines, and the very software protecting them became the vector.
Apply the general DLL side-loading principle: for any widely deployed third-party software running with elevated privileges, monitor DLL loading from the application directory — a shared attack surface exploited across many distinct campaigns.

References

The banana stand: brokering and managing infections across Asia using MQTT — Lumen Black Lotus Labs (September 2026)

Command Palette