A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems.

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux…

BambooToken is een nieuw ontdekte Linux backdoor die gebruikmaakt van het lichtgewicht berichtprotocol MQTT om externe commando's te ontvangen en gegevens te exfiltreren. MQTT, een protocol dat veel wordt toegepast in Internet of Things-omgevingen voor berichtuitwisseling via een centrale broker, wordt door deze malware ingezet voor zijn vermogen om verbindingen te onderhouden en berichten efficiënt te routeren. Bij activering decodeert BambooToken een configuratie van 59 bytes, die informatie bevat over de MQTT broker en een specifieke groepstopic die gebruikt wordt. De backdoor maakt vervolgens verbinding met de broker via TCP-poort 2883 en registreert een offline statusbericht. Eenmaal g...

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems.

Lumen exposes BambooToken, a stealthy 2023-era malware family using MQTT and sideloading to quietly infect targets across Asia and beyond.

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems.

The BambooToken malware has operated since February 2023 across roughly a dozen organizations, using the MQTT protocol for command-and-control and DLL sideloading via a legitimate signed executable to evade detection.

BambooToken turns an MQTT broker into a remote-control hub for Linux. Behind a 59-byte configuration blob, hex-encoded topics, and repeating XOR lies a backdoor built...

Researchers uncovered BambooToken, a multi-platform malware campaign that uses MQTT for command-and-control to target Windows and Linux systems across Asia and South America. The campaign appears to rely on DLL sideloading through Tendyron OnKey software, with infrastructure and targeting suggesting extensive data collection and possible China-linked activity. #BambooToken #Tendyron #OnKey #MQTT...

Linux版バックドア「BambooToken」は、MQTTをコマンド&コントロール(C2)チャネルとして使用しており、攻撃者はブローカー経由のトピックを通じて侵害したホストのプロファイリング、シェルコマンドの実行、ファイル転送を行うことができます。 静的にリンクされたx86-64 ELFサンプルの解析によると、その

Lumen exposes BambooToken, a stealthy 2023-era malware family using MQTT and sideloading to quietly infect targets across Asia and beyond.

Blog sobre seguridad de la informacion, ethical hacking, pentest

研究者らは、コマンド&コントロール(C2)通信にMQTTメッセージングプロトコルを使用するバックドア「BambooToken」と識別されたLinuxマルウェアの検体を分析しました。 このマルウェアは、システム情報の収集、シェルコマンドの実行、ファイルの閲覧、データのアップロード、そして侵害されたLinuxマシンからの

Curate Feeds | Make Collections | Customize Email Briefs

Lumen exposes BambooToken, a stealthy malware family using MQTT and sideloading to quietly infect targets across Asia and beyond. BambooToken is a new malware family that uses MQTT, a lightweight messaging protocol commonly found in smart devices and industrial systems, to quietly control infected Windows and Linux machines. Most malware connects directly to a command-and-control […]

The malware, which has been active since at least 2023, adopted MQTT for its command-and-control (C2) communications in variants developed between 2024 and 2025, according to a report by Black Lotus L...

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems.

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. [...]