Lumen links BambooToken malware to MQTT-based control of Windows and Linux enterprise systems

Updated: 2026.09.15 1M ago 2 sources

Threat Actors & APTs Malware Supply Chain

Researchers say a previously unknown malware framework called BambooToken has been used to control hacked Windows and Linux systems at enterprise targets since at least 2023. Lumen says newer 2024-2025 variants use MQTT, a lightweight message-broker protocol, for command-and-control to evade detection, and were delivered by side-loading through signed Tendyron OnKey software or by impersonating Kingsoft Office. Victims included mobile app backends, legal and financial services, software development infrastructure, and a GitLab server in Hong Kong.

Why it matters: This is a cross-platform backdoor aimed at real organizations, with tradecraft that can blend into normal network traffic and create long-term access, including possible supply-chain risk through compromised development servers. Defenders should hunt for the published indicators, review MQTT traffic and topic activity, and check for suspicious Tendyron OnKey and fake Kingsoft Office executions.

Sources

BambooToken Malware Uses MQTT to Control Windows and Linux Systems

info@thehackernews.com (The Hacker News) 2026.09.15 99% relevant

This article appears to cover the same underlying malware report, namely BambooToken using MQTT as command-and-control for compromised Windows and Linux enterprise systems.

BambooToken malware controls Windows and Linux systems via MQTT

Bill Toulas 2026.09.15 100% relevant

This article appears to be the first clearly scoped report establishing BambooToken as a distinct malware campaign using MQTT-based command-and-control against enterprise targets.