# BambooToken: The Malware That Speaks an IoT Protocol to Stay Hidden

## Overview

In September 2026, **Lumen Black Lotus Labs** published a report on **BambooToken** — a previously undocumented malware framework that operated undetected **from February 2023 through July 2026**, targeting both **Windows and Linux** systems.

What makes BambooToken particularly noteworthy is its command-and-control channel: instead of conventional HTTP/HTTPS, versions from 2024 onward switched to **MQTT (Message Queuing Telemetry Transport)** — a lightweight messaging protocol designed for **IoT devices and industrial sensors**, not for malware.

This choice delivers substantial operational advantages. MQTT works on a **publish-subscribe model through a central broker**: the infected machine **subscribes** to topics tied to a unique identifier, while the operator **publishes** commands into those same topics. The consequence: **the victim machine never connects directly to the attacker's infrastructure** — everything passes through the broker, completely concealing the real C2 server. MQTT's asynchronous nature also ensures **communications survive network disruptions**.

Black Lotus Labs identified approximately **12 compromised enterprise entities**, concentrated in **Asia and South America**, plus a separate campaign targeting roughly **150 MikroTik and DrayTek routers** across Southeast Asia.

* * *

## Why MQTT Is a Concerning Choice

MQTT was designed for IoT sensor networks: lightweight, bandwidth-efficient, tolerant of poor connectivity. Those same properties serve malware exceptionally well:

| **MQTT property** | **Original design purpose** | **Advantage for the attacker** |
| --- | --- | --- |
| Publish-subscribe via a broker | Lets many sensors send/receive data through a shared hub | **The victim machine never connects directly to C2** — it only talks to the broker, hiding the real infrastructure |
| Asynchronous communication | Sensors can go offline and receive data later | **Commands are not lost** during network interruptions; the implant receives queued commands when it comes back online |
| Topic-based routing | Routes data by subject | **Each infected machine gets its own GUID-based topic** → precise, independent control of individual hosts |
| Lightweight, common in industrial environments | Reduces load on resource-constrained devices | **MQTT traffic is typically unmonitored** in traditional enterprise networks |

**The key point for defenders:** most organizations monitor outbound HTTP/HTTPS/DNS closely, but **MQTT (ports 1883, 8883) usually falls outside that scope** — particularly at organizations that run no IoT/OT systems. When an office endpoint suddenly opens a persistent MQTT connection to the internet, that is almost certainly anomalous — but only if the organization has alerting configured for it.

* * *

## About the Threat Actor

| **Attribute** | **Detail** |
| --- | --- |
| **Framework name** | BambooToken (named by Lumen Black Lotus Labs) |
| **Active period** | **February 2023 – July 2026** (over 3 years) |
| **Target platforms** | Windows and Linux (multiplatform) |
| **Attribution** | **No definitive attribution.** Black Lotus Labs assesses this as **a skilled threat actor likely aligned with People's Republic of China (PRC) interests** — but **claims no formal nation-state attribution** |
| **Classification status** | Researchers **could not correlate this framework with any publicly documented activity cluster**, and label it an **emerging threat cluster** |

**Basis for the PRC-alignment assessment** (per Black Lotus Labs):

1.  **Tendyron OnKey software** is abused as the primary infection vector — software **widely deployed in Chinese banking and government networks**.
    
2.  **Most samples were uploaded from Chinese IP space**, with C2 telemetry geolocated inside China.
    
3.  **Sophisticated OPSEC techniques** and careful infrastructure compartmentalization.
    
4.  **TTPs consistent** with documented PRC-aligned actors such as **Volt Typhoon, GhostEmperor, and ZuoRAT**.
    
5.  **A targeting pattern focused on "discreet locations"** (Asia, South America) before potential expansion to higher-value targets — a documented PRC actor pattern.
    

* * *

## Technical Analysis

### 1\. Two Windows Infection Vectors

#### 1.1. DLL Side-Loading via Tendyron "OnKey" USB Token Software

This is the primary vector, and also the most contextually concerning detail.

**Tendyron** manufactures **hardware-based USB tokens** used in high-security settings to verify user identity for workstation access — meaning the software is typically installed on **precisely the machines an organization protects most carefully**.

The actor abuses a file vulnerable to sideloading — likely `OnKeySrv.exe` — to load a malicious payload named `OnKeyToken_KEB.dll`.

> **A critical detail worth emphasizing:** Black Lotus Labs assesses that **neither Tendyron's code-signing certificate nor its build environment was compromised**. This is **not a supply-chain attack against Tendyron** — the actor merely exploits a **legitimate but vulnerable execution flow** (Windows DLL search order), the exact same underlying principle seen in SLEEPWALKER (ESET) and MoiClient (SumatraPDF) in previous articles.

#### 1.2. Impersonating the Kingsoft Office Productivity Suite

Another Windows variant masquerades as legitimate software from **"Zhuhai Kingsoft Office Software Co., Ltd."** — a productivity suite (WPS Office) widely used in China.

This malicious variant **fails certificate signature validation**, confirming it was **not signed with legitimate credentials** but merely **spoofs the identity** of the real application.

* * *

### 2\. Evolution Across Three Versions

#### Version 1 (February 2023) — Starting With HTTP

The initial framework used **HTTP** for C2 communications. The agent checks for an `OnKeySrv.dat` file containing a **malleable profile** with C2 configuration. If unavailable, it falls back to **hardcoded C2 addresses** such as `api08.chat5188.tk`.

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/207aa696-3692-46b9-8f67-d8a39ad28d2f.png align="center")

Before establishing communications, the binary gathers system information: architecture, CPU details, memory, **public IP (via** `icanhazip.com`**)**, MAC address, and file information.

#### Version 2.0 (2024–2025) — The Move to MQTT

The most significant shift: **transitioning all C2 communications to MQTT**.

Windows variants employ **hijack flow execution** techniques, enumerating hosts through **WMI (Windows Management Instrumentation)** to collect OS information, product details, serial numbers, and licensing data.

#### Version 2.1 (from December 2025) — The Linux Variant

Compiled for **multiplatform** operations. Characteristics:

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/bc9bbae8-b63c-4a6a-92a7-66761b0d4964.png align="center")

*   **Three initialization arguments:** `i`, `p`, `v`, with **daemonization capability** (running in the background as a system service).
    
*   **Hardcoded C2:** `live-hk.c2iznja.com` and an **embedded GUID**.
    
*   **Substantially more robust host enumeration than its Windows predecessors** — collecting system BIOS, MAC address, CPU, memory, process/thread IDs, and architecture specifications.
    

* * *

### 3\. MQTT Architecture — Controlling Each Infected Host

The malware appears to use **Eclipse Mosquitto** — an open-source MQTT library — for its implementation.

Subscribed topics vary by malware version, but typically include **global broadcast channels** plus GUID-specific topics:

```plaintext
{GUID}/Plugin          — receive a new plugin
{GUID}/removePlugin    — remove a plugin
{GUID}/LUA             — execute LUA code
{GUID}/unPlugin        — unload a plugin
{GUID}/                — that host's general channel
```

**How it works:** each infected machine has a unique GUID. To command a specific host, the operator simply **publishes to the topic bearing that host's GUID**; to command the entire botnet, they publish to a broadcast channel. The central broker handles distribution — **the attacker never connects directly to the victim machine, and vice versa.**

* * *

### 4\. The Plugin Set — What Is Deployed and What Remains Unfinished

The framework supports **modular plugins**:

| **Handler / Plugin** | **Capability** | **Status** |
| --- | --- | --- |
| **SHELL** | Spawns command shell execution threads | Deployed |
| **FILEEX** | File upload, download, deletion, and execution control | Deployed |
| **ONLINE** | Collects and transmits host-based heartbeat beacons | Deployed |
| **Antivirus Plugin** | Uses WMI queries to **enumerate installed antivirus products every five seconds**, transmitting results to C2 via HTTP GET | Deployed (recovered by researchers) |
| `KEY_RECORD` | Keylogging | **Dead code — under development** |
| `COM_clipboard` | Clipboard data exfiltration | **Dead code — under development** |
| Audio recording | Audio capture | **Dead code — under development** |
| Webcam / desktop capture | Webcam and screen capture | **Dead code — under development** |

**A notable detail:** the AV enumeration plugin running **every five seconds** shows the actor places high priority on **closely tracking the defensive environment** on the victim host — very likely to decide whether to deploy the next payload, and which one.

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/cf10448a-2dbd-490b-b486-1c86daf6efa8.png align="center")

The presence of deep surveillance capabilities (keylogging, clipboard, audio, webcam) **as dead code** indicates this is a framework **still under active development** — future variants may well activate these capabilities in full.

* * *

### 5\. Victimology — And Three Points of Contact With Vietnam

#### 5.1. Enterprise victims (~12 organizations)

| **Sector** | **Specific victims** |
| --- | --- |
| **Software development** | A **GitLab instance in Hong Kong** (potential supply-chain attack vector); **a Vietnamese portable device manufacturer** |
| **Hospitality** | **A Vietnamese hotel** |
| **Financial services** | A Malaysian finance organization |
| **Legal services** | A Chilean law firm |
| **Biomedical** | An Argentine company |
| **Cryptocurrency** | A Lithuania-based crypto website |
| **Mobile app backend servers** | Cryptocurrency, chat, leisure/entertainment, lifestyle/wellness applications |

**Geographic distribution:** predominantly **Asia-Pacific** (Singapore, Cambodia, **Vietnam**, Hong Kong, Malaysia), with secondary targeting in **South America** (Argentina, Chile).

#### 5.2. Small-network infrastructure campaign — ~150 routers

Running alongside the enterprise campaign, Black Lotus Labs documented a separate operation targeting approximately **150 MikroTik and DrayTek routers** across Southeast Asia — geolocated to **Singapore, Cambodia, and Vietnam** — with **persistent MQTT connections** to C2 node `202.144.192.149`.

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/f87a954d-de6e-4cef-b76f-314bd1c5735d.png align="center")

**Why are routers attractive targets?** Edge routers typically: (1) have no EDR, (2) are rarely patched, (3) run 24/7, and (4) see all traffic from the network behind them. This is a pattern seen in other PRC-nexus campaigns (Volt Typhoon, ZuoRAT) — using edge devices as **operational relay boxes (ORBs)** or springboards into internal networks.

#### 5.3. The SpeedCN VPN angle — targeting the overseas Chinese community

The report identifies **"SpeedCN"** — described as **a VPN service for overseas Chinese users, allowing them to access Chinese websites without regional restrictions**.

The threat actor leveraged this service for command infrastructure, with **UDP-based connections from compromised routers terminating at VPN endpoints inside mainland China**.

Researchers hypothesize this targeting focuses on the **diaspora** — people physically located outside China who remain connected to the mainland ecosystem.

* * *

### 6\. Infrastructure and Timeline

**Active period:** February 2023 → July 2026

| **Phase** | **C2 domain** | **Notes** |
| --- | --- | --- |
| Historical | `chat5188.tk` | Peak operations **December 17, 2024**; reached **top 1 million** in Cloudflare Radar rankings |
| Current | `c2iznja.com` | Reached **top 500,000 domains** by **December 28, 2025** |

**Notable subdomains:** `api80.c2iznja.com`, `live-hk.c2iznja.com`, `turbo.c2iznja.com`, `base64.c2iznja.com`

**Infrastructure transition:** Two IP addresses — `210.1.231.13` and `202.144.192.149` — **appear across both historical and current domains**, indicating a **coordinated migration** of infected devices from deprecated to newer C2 infrastructure.

**Cloudflare proxy abuse:** Multiple domains are hidden behind the Cloudflare CDN (`cache.c2iznja.com`, `apis.chat5188.tk`, `chat.chat5188.tk`) — obscuring the true origin infrastructure.

> **Observation:** a C2 domain reaching the **top 500,000–1 million** in Cloudflare Radar rankings is a notable quantitative indicator of scale — this is not the traffic profile of a small, isolated campaign.

* * *

## Risk Summary

| **Risk Dimension** | **Level** | **Rationale** |
| --- | --- | --- |
| **Stealth** | **Very High** | MQTT falls outside most organizations' monitoring scope; victim machines never connect directly to C2 |
| **Undetected dwell time** | **Critical** | Operated for **over three years** (Feb 2023 – Jul 2026) before public disclosure |
| **Infrastructure resilience** | High | Broker architecture + Cloudflare proxy + coordinated infrastructure migration |
| **Platform reach** | High | Both Windows and Linux; plus MikroTik/DrayTek routers |
| **Escalation potential** | **High** | Keylogging, clipboard, audio, and webcam capture **already present as dead code** — awaiting activation |
| **Supply-chain risk** | **High** | A compromised GitLab instance; a targeted device manufacturer — both springboards for downstream attacks |
| **Relevance to Vietnam** | **High** | Two Vietnamese businesses compromised + Vietnamese routers in the botnet |

* * *

## IOCs & Artifacts

### C2 IP Addresses

| **IP** | **ASN / Country** | **Observed ports** |
| --- | --- | --- |
| `202.144.192.23` | ASN 63916, Japan | 1883/2883 (MQTT), 63196 (SSH) |
| `202.144.192.149` | ASN 63916, Japan | 1883/2883 (MQTT), 8883 (SSL MQTT), 63916 (SSH) |
| `210.1.226.238` | — | 8883 (SSL MQTT), 63196 (SSH) |
| `210.1.226.163` | — | 63916 (SSH) |
| `210.1.231.13` | ASN 45785, Malaysia | 443/1883 (MQTT), 63916 (SSH), 64332 (staging) |
| `43.245.198.195` | — | 1883 (MQTT), 63196 (SSH) |
| `43.245.198.238` | — | 1883 (MQTT), 63196 (SSH) |

### Domains

```plaintext
c2iznja.com               (current C2 domain)
  ├─ api80.c2iznja.com
  ├─ live-hk.c2iznja.com   (hardcoded C2 for the Linux v2.1 variant)
  ├─ turbo.c2iznja.com
  ├─ base64.c2iznja.com
  └─ cache.c2iznja.com     (behind Cloudflare)

chat5188.tk               (historical C2 domain)
  ├─ api08.chat5188.tk     (hardcoded C2 for version 1)
  ├─ apis.chat5188.tk      (behind Cloudflare)
  └─ chat.chat5188.tk      (behind Cloudflare)
```

### MQTT Topics (detection patterns)

```plaintext
{GUID}/Plugin
{GUID}/removePlugin
{GUID}/LUA
{GUID}/unPlugin
{GUID}/
+ global broadcast topics
```

### File Artifacts

| **Filename** | **Role** |
| --- | --- |
| `OnKeySrv.exe` | Legitimate Tendyron binary abused for side-loading |
| `OnKeyToken_KEB.dll` | **Malicious DLL** that is side-loaded |
| `OnKeySrv.dat` | Config file containing the malleable profile with C2 details (version 1) |

### Sample Hash (cited in the report)

```plaintext
SHA-256: dffa94a0f9c4dc38d475a32741f7f134cc934c7b98bec581c135da1b5aa1983f
```

### X.509 Certificate Fingerprint

```plaintext
SHA-256: 44e3580d84ba7534e815ae9c12c4165fbc9313adc7475808908fec26e9b17f19
```

> **The complete IOC list** (all sample hashes and certificate fingerprints) is in the Indicators section of the original Black Lotus Labs report — see References.

### Behavioral Indicators

*   **Persistent outbound MQTT connections** from endpoints or servers with no legitimate IoT/OT requirement — especially ports **1883** (plaintext MQTT), **2883**, and **8883** (MQTT over SSL).
    
*   **WMI queries enumerating AV products repeating every five seconds** — a highly distinctive pattern rarely seen in legitimate software.
    
*   **Requests to** `icanhazip.com` from an unrecognized process (version 1 used this to obtain the public IP).
    
*   `OnKeyToken_KEB.dll` **or** `OnKeySrv.dat` appearing in unusual locations alongside `OnKeySrv.exe`.
    
*   **Daemonized Linux processes** launched with the initialization arguments `i`, `p`, `v`.
    
*   **MikroTik/DrayTek routers** maintaining outbound MQTT connections — almost certainly anomalous for ordinary edge devices.
    

* * *

## MITRE ATT&CK Mapping

| **Tactic** | **Technique ID** | **Technique Name** | **Description in Campaign** |
| --- | --- | --- | --- |
| **Resource Development** | T1583.001 | Acquire Infrastructure: Domains | `chat5188.tk` → `c2iznja.com`, coordinated infrastructure migration |
| **Resource Development** | T1584.005 | Compromise Infrastructure: Botnet | ~150 MikroTik/DrayTek routers under control across Southeast Asia |
| **Execution** | T1129 | Shared Modules | Modular plugin architecture (SHELL, FILEEX, ONLINE, Antivirus) |
| **Persistence / Defense Evasion** | T1574.002 | Hijack Execution Flow: DLL Side-Loading | Abusing Tendyron's `OnKeySrv.exe` to load `OnKeyToken_KEB.dll` |
| **Defense Evasion** | T1036.005 | Masquerading: Match Legitimate Name or Location | Variant impersonating Kingsoft Office (Zhuhai Kingsoft) |
| **Defense Evasion** | T1518.001 | Software Discovery: Security Software Discovery | Plugin enumerating AV products every five seconds via WMI |
| **Defense Evasion** | T1027 | Obfuscated Files or Information | Malleable profile within `OnKeySrv.dat` |
| **Discovery** | T1082 | System Information Discovery | Collects architecture, CPU, memory, BIOS, MAC, process/thread IDs |
| **Discovery** | T1016 | System Network Configuration Discovery | Obtains public IP via `icanhazip.com`, MAC address |
| **Discovery** | T1047 | Windows Management Instrumentation | Enumerates OS, serial, licensing data via WMI |
| **Command and Control** | T1071 | Application Layer Protocol | **MQTT** as the primary C2 protocol (v2.0+); HTTP in v1 |
| **Command and Control** | T1102 | Web Service | Cloudflare CDN concealing origin C2 infrastructure |
| **Command and Control** | T1090 | Proxy | MQTT broker architecture + SpeedCN VPN as intermediary layers |
| **Command and Control** | T1573 | Encrypted Channel | MQTT over SSL (port 8883) |
| **Collection** | T1056.001 | Input Capture: Keylogging | `KEY_RECORD` — **dead code, under development** |
| **Collection** | T1115 | Clipboard Data | `COM_clipboard` — **dead code, under development** |
| **Collection** | T1123 / T1125 / T1113 | Audio Capture / Video Capture / Screen Capture | **Dead code, under development** |
| **Exfiltration** | T1041 | Exfiltration Over C2 Channel | AV enumeration results sent to C2 via HTTP GET |

* * *

## Expert Assessment

**The biggest lesson from BambooToken is not a new technique, but a question about monitoring scope.** MQTT is not a secret or technically evasive protocol — it is an open standard, fully documented, and extremely common in industrial settings. It works for attackers **only because most organizations never think to monitor it**. This is a form of "hiding by standing where nobody looks" — and it worked **for more than three years**.

**This raises a practical question for every security team:** what is on your organization's list of protocols actually monitored on egress? If the answer is "HTTP, HTTPS, DNS, and maybe SMB" — a very wide surface is left uncovered. MQTT is only one example; AMQP, CoAP, and other IoT/messaging protocols share the same attacker-friendly properties. Notably, earlier articles in this series documented **RabbitMQ/AMQP** in GigaWiper and **Redis** in that same campaign — this is not an isolated phenomenon but **a clear trend: shifting C2 onto legitimate messaging protocols.**

**The abuse of Tendyron OnKey carries an irony worth reflecting on.** That software exists to **verify user identity in high-security environments** — meaning it is installed on precisely the machines an organization trusts most and protects most carefully. The attacker did not break Tendyron's security mechanism; they simply **borrowed its legitimate execution flow.** A critical point to emphasize: **Tendyron's code-signing certificate and build environment were not compromised** — this is not a supply-chain attack on the vendor, but exploitation of the Windows DLL search order, the same principle as SLEEPWALKER (ESET) and MoiClient (SumatraPDF). **Three incidents, three different products, one shared underlying mechanism** — indicating a systemic attack surface rather than any single vendor's failure.

**On the dead code, read it for what it actually means.** That keylogging, clipboard theft, audio recording, and webcam capture **exist but are not yet deployed** does not mean the threat is lower — it means **this framework is still being actively invested in.** An actor that has sustained operations for three years without detection, and is still expanding its capabilities, is an actor with long-term plans. Public disclosure may force infrastructure changes — but the framework will very likely **persist in a new form.**

**For Vietnam, this is a specific warning at three distinct layers** — and that is precisely what makes it concerning:

First, **the enterprise layer**: a portable device manufacturer and a hotel in Vietnam are among the ~12 compromised organizations. The device manufacturer is particularly notable — combined with the compromised GitLab instance in Hong Kong, the pattern suggests **clear interest in supply-chain springboards** across the region.

Second, **the network infrastructure layer**: Vietnam is one of three countries with MikroTik/DrayTek routers under attacker control. These are exactly the devices **very widely used by Vietnamese SMEs** but rarely patched, rarely rotated off default credentials, and almost never monitored.

Third, **the sector layer**: hotels are a classic espionage target — guest data, itineraries, and shared Wi-Fi networks are valuable sources for tracking specific individuals. A Vietnamese hotel being targeted is unlikely to be incidental.

* * *

## Recommendations

### Network monitoring — highest priority

1.  **Configure alerting for outbound MQTT traffic** at the perimeter firewall: ports **1883** (plaintext MQTT), **2883**, and **8883** (MQTT over SSL). For most enterprises that run no IoT/OT systems, **any outbound MQTT connection warrants investigation**.
    
2.  **Expand the catalogue of monitored protocols** beyond HTTP/HTTPS/DNS — to include MQTT, AMQP, and other messaging protocols. Black Lotus Labs specifically recommends **implementing centralized firewall rules** to detect anomalous protocols traversing network boundaries.
    
3.  **Block all published IOCs** (the 7 C2 IPs and the `c2iznja.com` / `chat5188.tk` domains and subdomains) at firewall, proxy, and DNS layers.
    
4.  **Monitor large data transfer events**, alerting even when the destination is geographically nearby — a specific Black Lotus Labs recommendation, since most victims and C2 infrastructure sit within the same region.
    

### Router and edge device protection

1.  **Patch and harden routers immediately** — especially **MikroTik and DrayTek** devices in Vietnam, Singapore, and Cambodia. This is a direct recommendation from the original report.
    
2.  **Replace all default credentials** and harden SNMP configuration.
    
3.  **Check whether routers maintain outbound MQTT connections** — for ordinary enterprise routers, this is almost certainly a compromise indicator.
    
4.  For organizations lacking the resources to manage edge devices, **consider outsourced management** — also recommended in the report.
    

### Endpoint detection

1.  **Hunt for** `OnKeyToken_KEB.dll` and `OnKeySrv.*` files in unusual locations — particularly at organizations that have deployed Tendyron USB tokens.
    
2.  **Alert on repeated WMI queries enumerating AV products** at high frequency (every five seconds) — a highly distinctive BambooToken plugin signature.
    
3.  **Review Linux daemon processes** launched with unrecognized `i`, `p`, `v` initialization arguments.
    
4.  **Deploy centralized EDR** with routine signature updates, alongside automated detection and response services to identify lateral movement.
    

### Supply-chain governance

1.  **Map supply-chain dependencies** — maintain visibility of code dependencies and CI/CD pipeline security. The compromise of a GitLab instance in this campaign shows this is a priority target for the actor.
    
2.  **Separately audit machines running security token / hardware authentication software** — the paradox is that these are often the most critical machines, and the very software protecting them became the vector.
    
3.  **Apply the general DLL side-loading principle:** for any widely deployed third-party software running with elevated privileges, monitor DLL loading from the application directory — a shared attack surface exploited across many distinct campaigns.
    

* * *

## References

*   [The banana stand: brokering and managing infections across Asia using MQTT — Lumen Black Lotus Labs (September 2026)](https://www.lumen.com/blog/en-us/the-banana-stand-brokering-and-managing-infections-across-asia-using-mqtt)
    

* * *