BambooToken: A Nameless Malware Framework Taking Orders Over MQTT, The Protocol Your IoT Team Already Whitelisted

A malware framework nobody had named until this week has been running inside enterprise servers since 2023, and its command channel rides a protocol your IoT team already whitelisted.

Black Lotus Labs, the research arm of Lumen, published a report this week on BambooToken, a previously undocumented malware framework that controls infected Windows and Linux machines through MQTT, the lightweight messaging protocol built for sensors and telemetry devices. Variants active between 2024 and 2025 compromised servers behind mobile applications, along with law firms, financial services, hotels, a biomedical company, and a cryptocurrency site in Lithuania. Roughly a dozen enterprise victims so far, mostly in Asia and South America, though nothing about the technique limits it to those regions.

Why MQTT makes a nasty command-and-control channel

MQTT works through a central broker. An infected machine subscribes to a topic named after its own unique identifier, and the operator publishes commands to that topic. Status updates and stolen system information flow back out through the same broker. The infected host never talks to attacker infrastructure directly. It talks to a broker, and brokers live on legitimate cloud services that security teams have no appetite for blocking.

Two properties make this painful to detect. First, the traffic looks like machine telemetry: small, frequent payloads over a port the network already tolerates. Second, the communication is asynchronous. If the broker goes briefly offline or the network hiccups, the malware picks up its queued commands when connectivity returns. There is no dropped beacon, no retry storm, no obvious break in pattern.

ESET documented the same idea in 2023 with an unrelated backdoor they called MQsTTang, so this is a trend forming, not a one-off experiment.

The intrusion path is painfully ordinary

According to Black Lotus Labs, BambooToken got in by side-loading through a digitally signed USB-token utility from Tendyron, or by posing as the Kingsoft Office suite. Signed driver, familiar installer, ordinary helpdesk moment. The most compromised servers were the backend infrastructure of mobile apps, the quiet Linux boxes that serve APIs and rarely get the same monitoring budget as the web front end.

Here’s the detail that got me: the campaign compromised a GitLab server in Hong Kong. A code-hosting server inside your pipeline is a foothold for supply-chain attacks against everyone who pulls from it. The mobile-app backend angle matters doubly for that reason. Compromise the API server, and the malware inherits trust relationships you built for convenience.

A modular toolkit, some of it unfinished

Researchers recovered a BambooToken plugin that enumerates the antivirus products installed on a host and reports them back through the broker, a reconnaissance step before an operator decides what to deploy. Strings in the samples point to keylogging, clipboard theft, audio recording, webcam capture, and screenshots. The honest caveat: those capabilities sat in dead code, so whether they shipped in real operations is unconfirmed. The newest Linux variant, version 2.1 observed in December 2025, collects system inventory, spawns a command shell, and lets operators upload, download, and delete files. Lumen describes it as still under development.

That last part is what I keep turning over. A framework running quietly since 2023, and the operators are still building new modules. The targeting patterns are consistent with China-aligned operations, though Lumen declines to attribute it to a named group.

What this means for African enterprises

South African banks, insurers, and retailers run mobile apps at scale, and MQTT is standard in our telecom IoT estates, smart-metering fleets, and in-store device networks. Chances are good your firewall policy already permits MQTT traffic to broker endpoints because a logistics or facilities system needs it. Three practical responses:

• Audit your broker dependencies. Inventory every MQTT or message-broker endpoint your servers are allowed to reach, then verify each one is a broker your IoT or platform team actually owns. A public broker that nobody claims is an IOC, not a dependency.
• Constrain egress from app backends. The API servers behind your mobile apps have no business opening outbound sessions to arbitrary cloud brokers. Default-deny egress, allow by exception.
• Treat signed installers as a threat surface. USB-token utilities and office-suite knockoffs are the delivery vehicle here. Application allow-listing on server fleets closes that door cheaply.

Lumen has published indicators of compromise for the campaign. What the case exposes is structural: perimeter tools tuned for HTTP beacons and DNS tunneling are blind to a botnet that behaves like telemetry.

That gap is exactly where eHawu operates. Our network-layer monitoring profiles outbound flows at the packet level, so an app server quietly subscribing to a third-party MQTT broker shows up as an anomaly even when the protocol, the port, and the certificate all look clean. Built in South Africa for African enterprise estates, eHawu gives your SOC the one thing a stealthy C2 channel cannot fake: a baseline of what your servers are supposed to talk to. If your mobile backend estate is in scope for your next threat-model review, start with egress. Talk to eHawu.