BambooToken: MQTT-BasedEspionage Malware Targeting Asia and South America

Lumen’s Black Lotus Labs has uncovered BambooToken, an emerging multiplatform malware family
that hides its command-and-control inside MQTT, a lightweight messaging protocol normally used by
IoT devices, to quietly control infected Windows and Linux systems. Active since at least February
2023, the suspected China-aligned operator sideloads its agent through legitimate Tendyron ‘OnKey’
security software (widely used in Chinese banking and government), routes traffic through Cloudflare,
and collects data from targets across Asia and South America, including mobile-app backends, a
GitLab server, and finance, legal and hospitality organisations, as well as home and small-office
routers. Because MQTT lets the victim talk only to a message broker that hides the real C2 server, and
the malware carries surveillance capabilities such as shell access, file theft and dead-code references
to keylogging and webcam capture, this is a stealthy espionage threat. The report is a reminder to
watch for unusual MQTT traffic leaving the network, hunt for DLL side-loading, and harden edge
routers.

1. Campaign Overview

Black Lotus Labs identified BambooToken, an undocumented malware family that uses the MQTT publish-and-subscribe
protocol for command-and-control across Windows and Linux. Artifacts date the activity from at least February 2023
through July 2026. MQTT is rare in malware (only three prior campaigns are known) and benefits the attacker: the
compromised host communicates only with a broker that hides the real C2, messages are asynchronous, and the broker
must approve a bot’s subscription before it receives commands. The operator fronts its domains with Cloudflare, and two
C2 domains reached Cloudflare Radar’s top 500,000 and top 1 million, indicating wide-reaching campaigns. Lumen
labels this an emerging cluster and assesses it is suspected PRC-aligned

2. Targeting & Attribution

Lumen observed infections at mobile-application backend servers, a Hong Kong GitLab instance, a
smartwatch/lifestyle-device software firm, a hotel, and legal, financial and cryptocurrency entities across Asia and
South America (including Vietnam, Malaysia, Argentina, Chile and Lithuania), plus home and small-office routers
(MikroTik, DrayTek) in Singapore, Cambodia and Vietnam reached via SNMP scanning. Most samples were
uploaded from Chinese IP space, the sideloaded software (Tendyron, Kingsoft) is China-centric, and SoftEther
from-Hong-Kong tradecraft is a known PRC-aligned pattern, supporting Lumen’s suspected PRC-alignment
assessment. Neither Tendyron’s nor Kingsoft’s code-signing certificate was compromised; the actor abuses files
vulnerable to side-loading. The supply-chain footprint suggests broad access used to reach higher-value targets.

3. Attack Details

The chain relies on abusing trusted, China-centric software and an unconventional C2 channel.

• Initial Access DLL SIDE-LOADING: The actor abuses a legitimate, validly-signed Tendyron ‘OnKey’ (OnKeySrv) executable that is vulnerable to DLL side-loading to load a malicious OnKeyToken_KEB.dll; one variant masquerades as Kingsoft Office. The signingcertificates were not compromised.
• Execution IN-MEMORY AGENT: The agent XOR-decodes an embedded GUID used as a single-instance mutex, reads and decrypts an OnKeySrv.dat malleable profile to obtain a C2 node (or falls back to a hardcoded C2), and runs in memory; early samples began from an injected Update.log file.
• Command & Control MQTT: From version 2 the malware uses MQTT (Eclipse Mosquitto), subscribing to GUID-scoped topics (Plugin,removePlugin, LUA, Global) and publishing online/offline beacons, so the victim only ever talks to a broker that conceals the real C2, with domains fronted by Cloudflare.
• Collection ENUMERATION & HANDLERS: It enumerates the host via WMI (OS, BIOS, product key, MAC, licensing) and runs SHELL, FILEEX and ONLINE handlers for interactive shell, file upload/download/delete and heartbeat beaconing; an AV-enumeration plugin reports installed antivirus every five seconds.
• Expansion ROUTER COMPROMISE: The actor conducts internet-wide SNMP (port 161) scanning to compromise SOHO routers (MikroTik, DrayTek), which then beacon to the C2 over MQTT (port 1883), extending reach toward the Chinese diaspora and connected networks.

4. Malware & Capabilities

BambooToken has evolved across platforms while keeping a common codebase

• Windows agent (v1 2023 -> v2 2024-25) C++ agent, sideloaded and run in memory, with a GUID mutex and a plugin loader. Version 1 used HTTP C2; version 2 switched to MQTT and enumerates the host via WMI.
• Linux variant (v2.1, Dec 2025) An ELF build with the most extensive host enumeration, a five-topic MQTT structure, and SHELL/FILEEX/ONLINE handlers; assessed with high confidence to belong to the same cluster as the Windows tooling.
• MQTT C2 design Uses the Eclipse Mosquitto library for publish/subscribe C2 so infrastructure hides behind a broker, communication is asynchronous, subscriptions require broker approval, and domains sit behind Cloudflare.
• Surveillance capabilities A confirmed antivirus-enumeration plugin, plus dead-code strings indicating planned or modular capabilities: a keylogger (KEY_RECOURD), clipboard access (COM_clipboard), and audio, webcam and desktop capture, enabling credential theft and pattern-of-life collection.

5. Indicators of Compromise (IOCs)

6. Recommendations

• Detect anomalous MQTT: alert on outbound MQTT traffic (ports 1883, 2883 and 8883) leaving the network, particularly to Cloudflare-fronted or otherwise unusual destinations, since MQTT egress from ordinaryservers and endpoints is a strong indicator of this threat.
• Hunt the side-loading chain: look for OnKeySrv.exe loading OnKeyToken_KEB.dll, an OnKeySrv.dat profile file, Update.log injectors, and binaries impersonating Tendyron OnKey or Kingsoft Office that fail certificate signature validation.
• Harden SOHO and edge routers: patch MikroTik and DrayTek devices, disable external SNMP (port 161) or change default community strings and passwords, and restrict management exposure, since the actor scans SNMP for initial access.
• Build supply-chain visibility: map code dependencies with a secured CI/CD pipeline, and closely scrutinise GitLab and developer servers and mobile-application backends for compromise, given the campaign’s supply-chain targeting.
• Deploy and tune EDR across Windows and Linux for in-memory injection, DLL side-loading and the surveillance behaviours (antivirus enumeration, keylogging, clipboard, webcam and desktop capture), and monitor for large outbound data transfers even when the destination is in the same region.
• Block the IOCs at their respective controls (the C2 IP addresses and domains in the Indicators of Compromise section) and ingest Black Lotus Labs’ continuously-updated Banana Stand IOC list from their GitHub.

Sources

• https://www.lumen.com/blog/en-us/the-banana-stand-brokering-and-managing-infections-acrossasia-using-mqtt
• https://github.com/blacklotuslabs/IOCs/blob/main/Banana_Stand_IOCs.txt

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.