[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQ92Y0WsDO73OSKLaECEa3xLQ5lDUq8FwmLqWi7EBccI":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"79277bbd-0629-4f6a-b893-579f51f5cd18","BambooToken malware controls Windows and Linux systems via MQTT","bambootoken-malware-controls-windows-and-linux-systems-via-mqtt-05ce5f","A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. [...]","A new malware framework named BambooToken, active since at least 2023, has been observed using the MQTT protocol for command-and-control communications. This technique allows for evasion and resilience by avoiding direct connections to attacker infrastructure. Variants have been developed for both Windows and Linux, with observed targets including mobile app servers, legal and financial services, and software development, primarily in Asia and South America.","BambooToken malware uses MQTT for C2, targeting Windows and Linux systems.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbambootoken-malware-controls-windows-and-linux-systems-via-mqtt\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F03\u002F05\u002Fhand.jpg","2026-09-15T15:00:00+00:00","2026-09-15T16:00:18.360813+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Tendyron OnKey USB-token software","product",{"name":21,"type":19},"Kingsoft Office",{"name":23,"type":19},"GitLab",{"name":25,"type":26},"MQTT","technology",{"name":28,"type":29},"ESET","vendor",{"name":31,"type":29},"Lumen","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59],{"type":36,"value":57,"context":58},"BambooToken","Malware framework name",{"type":36,"value":60,"context":61},"MQsTTang","Previously documented unrelated backdoor using MQTT",[28,31,18],{"controls":64,"vendors":147},[65,93,122],{"slug":66,"name":67,"problem":68,"products":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":87,"vendor_name":28,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"eset","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":94,"name":95,"problem":96,"products":97},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":54,"name":123,"problem":124,"products":125},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":143,"product_name":144,"url":145,"description":146},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[148],{"slug":87,"name":28,"logo_path":88,"roles":149},[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":166},"bambootoken-malware-hijacks-systems-using-mqtt-protocol-for-stealthy-c2","BambooToken Malware Hijacks Systems Using MQTT Protocol for Stealthy C2","BambooToken exploits the MQTT protocol — commonly used for IoT messaging — as a covert command-and-control channel, allowing attackers to blend malicious traffic with legitimate business communications and avoid detection. By routing C2 traffic through MQTT brokers rather than direct attacker infrastructure, the malware gains resilience against traditional IP-based blocking and takedown efforts. Its cross-platform design targeting both Windows and Linux systems significantly broadens the attack surface, particularly for organizations in financial, legal, and software development sectors. This highlights the danger of permitting non-standard or poorly monitored protocols to traverse enterprise networks without inspection. Organizations that lack deep packet inspection and protocol-level monitoring are effectively blind to this class of threat.",[156,157,158,159,160,161,162,163,164,165],"CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 AC-17: Remote Access","MITRE ATT&CK T1071.001: Application Layer Protocol – Web Protocols","MITRE ATT&CK T1095: Non-Application Layer Protocol","NIST CSF DE.CM-1: Network Monitoring","ITIL: Event Management – Anomalous Protocol Detection",{}]