BambooToken Framework and the Rise of MQTT-Based Command and Control

The malware operates as a highly modular cyberespionage tool designed for both Windows and Linux environments. By utilizing an MQTT publish/subscribe model instead of traditional HTTP beaconing, BambooToken routes communications through a central broker. This architecture completely masks the attacker's true infrastructure, bypasses standard web proxies, and ensures high operational resilience by queueing commands for hosts that temporarily drop offline.

‍

Attack Chain

• Initial Access & Execution: The threat actors primarily target mobile application backends, GitLab servers, and edge network infrastructure to establish a foothold. Early variants relied on PowerShell stagers designed to allocate system memory and execute initial payloads that masqueraded as benign files. ‍
• Persistence & Defense Evasion: The framework bypasses endpoint security via DLL side-loading. Attackers drop a malicious library (OnKeyToken_KEB.dll) into the same directory as a vulnerable, digitally signed executable. Linux variants achieve persistence using cron jobs and specific command-line arguments to daemonise the process silently.
• ‍Discovery & Collection: Upon execution, the malware leverages Windows Management Instrumentation (WMI) to enumerate the host’s hardware architecture, installed antivirus solutions, and firewall configurations. Furthermore, "dead code" found within the binaries indicates a modular capacity for deep espionage, including keystroke logging, clipboard harvesting, and covert audio/webcam recording.
• ‍Command & Control (C2): BambooToken completely replaces traditional HTTP beaconing with the MQTT publish/subscribe protocol over TCP ports 1883 (unencrypted) and 8883 (TLS-encrypted). The malware generates a unique host GUID to subscribe to specific operational topics via a central broker. To mask their infrastructure, the attackers route this C2 traffic through Cloudflare proxies and compromised edge routers. Furthermore, because attackers can potentially abuse legitimate, publicly accessible MQTT brokers (like test.mosquitto.org), blocking these communications based purely on IP reputation is highly impractical.

Attribution and Threat Actor Overlap

While initially tracked as an emerging threat cluster, deep forensic analysis revealed that BambooToken shares striking technical and strategic overlaps with established China-aligned advanced persistent threats (APTs), specifically TA410 and Mustang Panda.

• The TA410 (FlowingFrog) Connection: BambooToken’s highly specific execution chain almost identically mirrors the operations of TA410. Both BambooToken and TA410’s "FlowingFrog" subgroup exploit the exact same Tendyron Corporation executable (OnKeySrv.exe) to side-load a malicious library named OnKeyToken_KEB.dll.  ‍
• The Mustang Panda Connection: BambooToken’s architectural pivot to the MQTT protocol in early 2023 occurred at the exact same time that Mustang Panda deployed its own MQTT-based backdoor, MQsTTang.
• ‍Infrastructure and Victimology: The geopolitical nexus is further supported by the malware’s targeting profiles and infrastructure; pointing toward a coordinated espionage mandate designed to monitor overseas communications and execute supply chain compromises.

‍

Mitigations and Recommendations

• Network Protocol Filtering: Because standard corporate workstations have no legitimate business need to generate IoT telemetry, organizations should configure edge firewalls and secure web gateways to explicitly block outbound traffic on TCP ports 1883 and 8883. ‍
• Broker Allow-Listing & Zero Trust: If MQTT is required for operational technology (OT) or specific applications, implement strict network segmentation and enforce broker allow-listing. Endpoints must only be permitted to communicate with known, internally validated brokers. ‍
• EDR Tuning for Side-Loading: Configure alerts for trusted binaries (like OnKeySrv.exe) that unexpectedly spawn child processes, drop files, or initiate outbound network connections on port 1883. ‍
• Edge Device & Software Hardening: Ensure all perimeter routing devices are immediately patched against known vulnerabilities, disable external SNMP, and enforce multi-factor authentication (MFA) on all administrative interfaces. Additionally, lock down software installation directories to prevent the unauthorized placement of malicious DLLs alongside legitimate applications.

‍