BambooToken Malware Exploits MQTT Protocol for Multi-Platform Control

Researchers have disclosed details of a multi-platform malware campaign codenamed BambooToken. The threat actor(s) behind the operation use the Message Queueing Telemetry Transport (MQTT) protocol as a command-and-control (C2) channel to control infected Windows and Linux systems. MQTT, a lightweight publish-subscribe messaging protocol commonly deployed in IoT and industrial environments, is abused as a covert communication pathway. The campaign has been active since at least February 2023 and has targeted organizations across Asia and South America. The use of MQTT as a C2 channel allows the malware to blend into normal network traffic, making detection more difficult without specific monitoring of MQTT broker activity. No specific CVE or software vulnerability has been identified as the initial infection vector; the malware likely enters systems through other means such as phishing, compromised downloads, or exploitation of exposed services. The disclosure highlights the growing trend of threat actors abiding legitimate protocols for malicious C2 purposes.