17 SEP 2026 — A malware family active since at least 2023 takes its orders over MQTT, the lightweight messaging protocol built for sensors and smart devices. Infected machines never connect to an attacker's server. They subscribe to a topic on a message broker and wait for instructions.
Lumen's Black Lotus Labs, which found the malware on VirusTotal early this year and named it BambooToken, counts about a dozen compromised organisations, most of them in Asia and South America.
Why the protocol matters
MQTT was designed for devices that are small, numerous and intermittently connected. A publisher sends a message to a topic on a broker; anything subscribed to that topic receives it. Nobody needs to know where anybody else is.
Using MQTT for command and control removes the trail defenders usually look for. An infected host never beacons to the attacker's server; it talks only to a message broker, which is ordinary infrastructure. The traffic is asynchronous, so an operation survives a machine being offline for a day. Each host subscribes to a topic keyed to its own identifier, letting one operator control many victims without a central, obvious channel.
The malware publishes back to the same broker with system information and command results. To a network monitor, an infected server is a device speaking a protocol that thousands of legitimate devices speak.
How it gets in
The route is DLL sideloading. BambooToken rides a digitally signed component of Tendyron's OnKey software, a USB security-token product, which loads a rogue library alongside the legitimate one. Later samples impersonate the Kingsoft Office productivity suite.
An early variant was a PowerShell stager. The MQTT versions were developed across 2024 and 2025, and a Linux build, version 2.1, appeared in December 2025 still looking unfinished.
Who was hit, and where
The victim list is concentrated in this region. Reporting on the research names a finance organisation in Malaysia, a hotel and a lifestyle device developer in Vietnam, and a GitLab server in Hong Kong, alongside a biomedical company in Argentina, a law firm in Chile and a cryptocurrency site registered in Lithuania.
Most of the compromised servers were running back-end infrastructure for mobile applications. That is not the phone in someone's hand; it is the machine every copy of an app talks to.
Communicating addresses were observed in Singapore, Cambodia and Vietnam, on MikroTik and DrayTek routers. Small-office routers acting as relays are a familiar pattern here; the geography of the traffic is not the geography of the operator.
What the researchers do and do not say
No group is named. Black Lotus Labs assesses the targeting as consistent with China-aligned operations, and points to the sideloading technique, uploads arriving predominantly from Chinese address space, and a SoftEther VPN link between a virtual private server and the command nodes. BleepingComputer reports that ESET worked on the research as well, and notes possible interest in overseas Chinese users through the SpeedCN VPN service.
This is weaker than a direct attribution. Techniques travel, address space is rented, and these clues do not name a specific organisation.
Read the capability inventory carefully. The samples confirm host enumeration, antivirus detection through Windows management instrumentation, plugin loading and termination, and file transfer. Keylogging, clipboard theft, audio recording, webcam capture and screenshots are present only as unused code. The unused code suggests intent, but not an installed capability.
What defenders can act on
Lumen has published indicators of compromise. The immediate task is to match them, and to check whether anything in the estate is speaking MQTT that has no business doing so.
The second check is the more durable defence. Most enterprise networks carry some legitimate MQTT traffic from building systems or sensors, but almost none have a policy governing which hosts may speak it. An allowlist of the machines that should be publishing to a broker makes the technique obvious instead of invisible.
The sideloading half is answerable too. Application allowlisting that pins signed binaries to their expected directories defeats the OnKey and Kingsoft impersonation route, and it defeats the next one as well.
What to watch
Start with the Linux build. A version that looked unfinished in December has had nine months, and Linux is what the application back-ends in this victim list actually run.
Then watch the protocol choice spread. Command and control over ordinary application protocols is not new, but MQTT brokers sit in a blind spot between network monitoring and application security, and techniques that work get copied.
Then consider the regional shape. A finance organisation in Malaysia and two companies in Vietnam are not a pattern by themselves, but this is the second Asia-heavy victim list this month, after the print-server campaign we covered last week.
View author profile → · Editorial policy
