2026-09-16 · view entry permalink →
BambooToken, a previously undocumented MQTT-based malware framework sideloads via a signed Chinese hardware-token utility to control Windows and Linux hosts
Lumen's Black Lotus Labs disclosed BambooToken on 2026-09-15: an emerging, previously undocumented malware framework that, based on embedded artifacts, has been active since at least February 2023 and continued through July 2026 (Lumen Black Lotus Labs, 2026-09-15). The most recent sample Lumen correlated to the campaign, a Linux build, was first observed in December 2025 (Lumen Black Lotus Labs, 2026-09-15). Rather than the direct HTTP callbacks its 2023 version used, the current Windows and Linux toolset communicates over MQTT, a publish/subscribe protocol built for IoT device control: infected hosts publish and subscribe to topics through a broker rather than contacting a command server directly, so a compromised machine never talks to the attacker's infrastructure at all, and the channel supports asynchronous tasking that survives temporary network disruption (Lumen Black Lotus Labs, 2026-09-15). Lumen's own review of prior campaigns found only three other malware families that have ever used MQTT for command and control (IOCONTROL, Korplug/PlugX and WailingCrab) making this a rare, not novel, technique choice.
The Windows variant is sideloaded through Tendyron's "OnKey" utility, a digitally signed USB hardware-token program that verifies cryptographic material for identity checks and is widely deployed across Chinese banking and government networks ("The Windows agent was sideloaded by the Tendyron 'OnKey' program, which validates system access by retrieving cryptographic material stored on a USB drive. This product line is popular in Chinese banking and government networks," Lumen Black Lotus Labs, 2026-09-15). One variant instead masquerades as "Zhuhai Kingsoft Office Software Co., Ltd." Lumen assesses neither Tendyron's nor Kingsoft's code-signing certificate was compromised: the OnKey binary itself is genuinely signed but merely vulnerable to sideloading rather than abused through a certificate compromise, while the Kingsoft-masquerading variant's own files fail certificate-signature validation outright, confirming that certificate was never actually applied to them (Lumen Black Lotus Labs, 2026-09-15).
Once running, the malware enumerates the host through Windows Management Instrumentation (operating system details, computer system product details, the original product key, serial number and software licensing service information) then subscribes to a global broadcast topic plus per-host, GUID-scoped topics and publishes an online/offline heartbeat carrying that GUID (Lumen Black Lotus Labs, 2026-09-15). Three command handlers have been identified: SHELL spawns a command shell, FILEEX uploads, downloads and deletes files, and ONLINE collects and beacons a separate set of host parameters, including BIOS and system details, as a heartbeat (Lumen Black Lotus Labs, 2026-09-15). A recovered plugin performs security-software discovery via WMI on a five-second timer and reports results over plain HTTP. Static "dead code" strings referencing clipboard capture, keylogging, audio recording and webcam capture were found in one sample's unexecuted code sections (Lumen Black Lotus Labs, 2026-09-15); because the detail comes from dead code, researchers cannot confidently determine whether these modules were ever operational or remain under development (BleepingComputer, 2026-09-15).
Lumen's telemetry links a dozen compromised enterprise environments mostly located in Asia, with a handful in South America (named examples include a biomedical company in Argentina and a legal firm in Chile) spanning mobile-application backends, legal and financial services, a smartwatch-adjacent software company, a hotel and a GitLab instance in Hong Kong, the last of which the report flags as a software-supply-chain concern given the developer access such a compromise could yield (Lumen Black Lotus Labs, 2026-09-15). A separate cluster of over 150 infected small-office and home routers was reached through internet-wide SNMP scanning; a handful of those IPs held persistent connections to an active C2 node over the MQTT port, and Lumen identifies the underlying devices in that handful as primarily MikroTik and DrayTek routers geolocated to Singapore, Cambodia and Vietnam. Lumen believes this pool primarily supports data collection against the Chinese diaspora rather than serving as C2 relay infrastructure (Lumen Black Lotus Labs, 2026-09-15). Command-and-control domains sit behind Cloudflare, with one domain reaching Cloudflare Radar's top 500,000 most-popular domains and an older one the top million at the height of its use, evidence of a wide, established infection base rather than a narrow test deployment (Lumen Black Lotus Labs, 2026-09-15). Lumen assesses the targeting pattern as consistent with China-aligned operations but states it cannot attribute the cluster to any publicly documented actor.
Black Lotus Labs®, the threat research division at Lumen, uncovered BambooToken, an emerging malware family using the Message Queueing and Telemetry Transport (MQTT) to quietly control infected Windows and Linux systems.
The Windows agent was sideloaded by the Tendyron “OnKey” program, which validates system access by retrieving cryptographic material stored on a USB drive. This product line is popular in Chinese banking and government networks.
Lumen does not assess that Tendyron's code signing certificate was compromised. Preliminary analysis indicates the signed executable appears benign and was vulnerable to side-loading rather than actively abused through a certificate compromise.
This approach has the advantage that infected systems do not connect directly to the attacker’s infrastructure, which increases evasion and resilience. At the same time, communications can be asynchronous, ensuring operational continuity during temporary network disruptions.