# New Multi-Platform Malware Leverages MQTT Protocol to Commandeer Windows and Linux Systems
A previously unknown malware family has been identified by security researchers, operating across multiple operating systems and leveraging an unconventional communication protocol to maintain persistent control over compromised machines. The threat, tracked under the name **BambooToken**, has been linked to a sustained campaign that appears to have been active since early 2023.
## How the Malware Operates
BambooToken is designed to infiltrate and control both Windows and Linux environments, using the Message Queueing Telemetry Transport (MQTT) protocol as its primary command-and-control (C2) channel. MQTT is a lightweight messaging framework commonly associated with Internet of Things (IoT) devices, making it an appealing choice for threat actors seeking to blend in with legitimate network traffic.
The malware’s delivery mechanism involves a technique known as DLL sideloading. The attackers exploit a legitimate software product called Tendyron OnKey — a hardware-based Public Key Infrastructure (PKI) USB token used for identity verification in secure environments. By injecting a malicious dynamic-link library (specifically “OnKeyToken_KEB.dll”) into the legitimate OnKeySrv software, the malware can execute within trusted processes on machines that already have the program installed.
In its early stages, BambooToken was deployed via PowerShell scripts that acted as a “stager,” allocating memory and launching the malicious payload. As the campaign evolved, the attackers shifted toward sideloading techniques to reduce the likelihood of triggering endpoint detection and response (EDR) alerts.
## Scope of the Campaign
The campaign has targeted organizations across Asia and South America, with victims spanning a wide range of industries including finance, hospitality, healthcare, legal services, and cryptocurrency. Specific targets identified include:
– Mobile application developers and related infrastructure
– A GitLab server located in Hong Kong
– A Vietnamese firm developing portable lifestyle management devices
– Hotels in Vietnam
– A biomedical company in Argentina
– A legal firm in Chile
– A cryptocurrency website in Lithuania
– A financial organization in Malaysia
Security researchers also noted that compromised routers from manufacturers MikroTik and DrayTek were communicating with active C2 infrastructure, further highlighting the broad attack surface.
## Technical Capabilities
Once established on a host, BambooToken collects detailed system information and transmits it to a remote C2 server. The malware can also deploy additional plugins, including a dedicated antivirus reconnaissance module for Windows that leverages the Windows Management Instrumentation (WMI) framework to enumerate installed security products on the machine.
The C2 infrastructure relies on Cloudflare as a proxy layer, making it harder to trace back to the operators. One domain associated with the 2025 wave of activity climbed into the top 500,000 most visited domains on Cloudflare Radar, while an older domain peaked within the top 1 million during 2024 — suggesting the campaigns reached significant scale over time.
The Linux variant, which emerged around December 2025, maintains the same MQTT-based communication strategy, demonstrating the attackers’ ability to expand their operational footprint across platforms.
## Attribution and Motivation
While the exact threat actor behind BambooToken has not been confirmed, several indicators point toward a connection to China. The DLL sideloading technique, combined with SoftEther VPN traffic routing through a Virtual Private Server (VPS) to a C2 node, aligns with tactics previously associated with Chinese state-sponsored groups. Additionally, a majority of the malware samples uploaded to public malware repositories originated from Chinese IP address ranges, reinforcing the geographic focus of the operation.
The targeting pattern strongly suggests a data collection operation. Compromised mobile applications and wearable devices could enable behavioral profiling, while attacks on financial institutions may expose transaction records. Hospitality systems, meanwhile, could yield travel histories and itinerary details.
## MQTT as a Weaponized Protocol
The use of MQTT for command-and-control is not entirely novel. In early 2023, a Chinese advanced persistent threat (APT) group known as Mustang Panda deployed a backdoor called **MQsTTang** that used the same protocol to communicate with compromised hosts. BambooToken appears to share similarities in its use of this protocol, though no direct overlap between the two campaigns has been confirmed.
Other known instances of MQTT being weaponized include:
– **Tizi** — An Android-based malware capable of harvesting data from messaging and social media applications, using MQTT or HTTPS for C2 communications.
– **WailingCrab** (also known as WikiLoader) — A malware loader distributed through shipping and delivery-themed phishing emails, attributed to the group Bamboo Spider.
– **IOCONTROL** (also known as OrpaCrab) — An operational technology malware targeting IoT and SCADA systems in Israel and the United States.
## Indicators of Compromise
BambooToken has been associated with the following indicators that organizations should monitor for:
– C2 domains including **chat5188[.]tk** and **api80.c2iznja[.]com**
– The malicious DLL file **OnKeyToken_KEB.dll**
– Network traffic to Cloudflare-proxied infrastructure originating from unexpected internal hosts
– Suspicious MQTT protocol connections from workstations or servers
The domains used in these campaigns have been routed through Cloudflare infrastructure, which complicates direct takedown efforts and allows the operators to scale their operations efficiently.
—
## Frequently Asked Questions (FAQ)
### What is BambooToken?
BambooToken is a multi-platform malware family that targets both Windows and Linux systems. It uses the MQTT protocol for command-and-control communications and is delivered via DLL sideloading of a legitimate software product called Tendyron OnKey.
### How does BambooToken get onto victim machines?
The malware is introduced through a technique called DLL sideloading, where a rogue dynamic-link library (“OnKeyToken_KEB.dll”) is loaded into the trusted process of the Tendyron OnKeySrv software. Initial deployment in earlier iterations was also achieved through PowerShell-based stagers.
### Which operating systems does BambooToken affect?
BambooToken has been observed targeting both Windows and Linux environments, with the Linux variant emerging around December 2025.
### What is the purpose of the malware?
Evidence strongly suggests that BambooToken is used for extensive data collection, including harvesting system information, enumerating installed antivirus products, and potentially profiling users through compromised mobile applications and IoT devices.
### Who is behind the BambooToken campaign?
The exact threat actor remains unidentified. However, indicators such as the DLL sideloading technique, VPN routing through a VPS, and the concentration of uploaded samples from Chinese IP address space suggest a likely connection to Chinese threat activity.
### Why use MQTT for command-and-control?
MQTT is a lightweight, publish-subscribe protocol commonly used in IoT environments. Its use allows threat actors to blend C2 traffic in with legitimate IoT communications, making detection more difficult.
### Has BambooToken been active recently?
Yes. Activity linked to BambooToken has been detected as recently as July 2026, indicating an ongoing and active campaign.
### How can organizations protect themselves?
Organizations should monitor for the known indicators of compromise, inspect DLL loading behavior on systems running Tendyron OnKey, analyze MQTT traffic for anomalous patterns, and ensure endpoint detection and response tools are properly configured to flag sideloading attempts.
—
## Conclusion
BambooToken represents a significant and evolving threat that highlights the growing sophistication of multi-platform malware campaigns. By exploiting trusted software supply chain components through DLL sideloading and adopting the MQTT protocol for covert command-and-control, the attackers have managed to maintain a persistent and widespread campaign over several years without detection.
The breadth of targets — from financial institutions to hospitality networks and biomedical companies — underscores the campaign’s strategic focus on data collection across diverse sectors. The geographic concentration in Asia and South America, combined with technical indicators pointing toward a Chinese nexus, suggests a well-resourced and targeted operation.
Security teams should remain vigilant for signs of MQTT-based C2 communications and sideloading activity, particularly on systems known to run the Tendyron OnKey software. The continued evolution of BambooToken, including its expansion to Linux platforms, signals that this threat actor is adapting and refining its capabilities in response to defensive measures.
Thank you for reading
