A malware family stayed hidden inside enterprise networks across Asia and South America for more than three years by doing something almost no defender was watching for: talking over MQTT, the lightweight messaging protocol built for smart thermostats and factory sensors, not spyware. Lumen’s Black Lotus Labs disclosed the campaign on September 18-19, 2026, naming it BambooToken and tracing its activity back to at least February 2023. The disclosure, corroborated by The Hacker News, BleepingComputer, and SecurityAffairs, describes a China-nexus operator that compromised roughly a dozen organizations, including a GitLab server in Hong Kong that could have served as a supply-chain foothold.
The story matters beyond one threat group’s tradecraft. BambooToken is a case study in how attackers exploit the blind spots created by IoT-era protocols spreading into enterprise IT, and how DLL sideloading through legitimately signed software keeps outrunning signature-based defenses, part of a pattern Tech Insider has tracked across the wider 2026 cybersecurity threat landscape. Here’s what Lumen found, how the malware works, and what it signals for the wider security industry heading into 2027.
What Lumen Found: A Malware Family Hiding in Plain Sight
Lumen’s Black Lotus Labs threat intelligence team discovered BambooToken after spotting previously undocumented samples on VirusTotal in early 2026. Working backward from those samples, researchers assessed the campaign had been running since at least February 2023, meaning it operated undetected for roughly three and a half years before the public write-up. Lumen published its findings under the title “The banana stand: brokering and managing infections across Asia using MQTT”, crediting the malware’s low profile to a skilled, patient operator rather than a smash-and-grab crew.
What separates BambooToken from typical enterprise malware is the transport layer it rides on. Instead of the HTTP, HTTPS, or DNS channels most network security tools are tuned to inspect, BambooToken’s operators built its command-and-control infrastructure on MQTT, the publish/subscribe protocol that underpins internet-of-things telemetry, smart-building systems, and industrial sensor networks. According to Lumen and corroborating reporting from The Hacker News, that choice let the malware blend its traffic in with legitimate IoT data streams flowing through the same corporate networks.
Why MQTT Makes an Effective Cover for Command and Control
MQTT was designed for efficiency on constrained devices: small messages, a lightweight publish/subscribe model routed through a central broker, and minimal overhead. Those same properties make it an appealing C2 channel for an attacker who wants to avoid detection. A broker-routed protocol means the infected host never talks directly to an attacker-controlled server in a way that looks unusual. It publishes to a topic, and the operator’s infrastructure subscribes to that same topic, mimicking the exact pattern a real sensor network would use.
Because most enterprise network security tooling was built to scrutinize web and DNS traffic, MQTT streams frequently pass through with far less inspection. BleepingComputer’s reporting on the disclosure notes that BambooToken uses this gap deliberately, routing commands to infected Windows and Linux machines through an MQTT broker rather than a conventional C2 server. That single design choice explains much of why the campaign avoided detection for as long as it did.
The Sideloading Trick: Abusing a Legitimate Signed Application
BambooToken’s second evasion technique is DLL sideloading, a method where malware places a malicious library alongside a legitimate, digitally signed executable so the trusted program loads the attacker’s code instead of (or alongside) its own. According to a detailed technical writeup on Dev.to and corroborated by SecurityAffairs, the operators abused Tendyron’s OnKey software, a legitimate identity and authentication product, to deliver their payload. On Windows systems, the malicious library, tracked as OnKeyToken_KEB.dll, sideloads into the legitimate, signed OnKeySrv.exe process.
Sideloading through a signed binary is a well-worn evasion technique precisely because it works. Endpoint security tools that trust code signing certificates, or that allowlist known-good executables by name, can miss a malicious DLL riding alongside them. Researchers say BambooToken’s operators refined this approach between 2024 and 2025, the same window when the malware also pivoted to MQTT for its C2 channel, suggesting a deliberate, iterative effort to reduce its detection footprint over time rather than a static toolset.
Who Got Hit: A Dozen Organizations Across Two Continents
Lumen’s telemetry identified roughly a dozen compromised enterprise entities, concentrated primarily in Asia and South America. The victim list spans an unusually broad mix of industries: hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency-related website based in Lithuania. That spread suggests either an opportunistic targeting model or an operator gathering footholds across sectors for future use, rather than a campaign built around a single industry vertical.
One compromise stands out for its downstream risk: a GitLab server located in Hong Kong. A compromised source-control or CI/CD server is a classic supply-chain pivot point, giving an attacker the potential to tamper with code before it ships to downstream customers or systems. Lumen’s report flags this specific compromise as creating a potential foothold for supply-chain attacks, a concern that echoes the broader pattern security teams have tracked all year around DevOps tooling as an attack surface, including the critical CVE-2026-85706 vulnerability that hit GitLab’s own platform earlier in 2026.
| Attribute | Detail |
|---|---|
| Malware family | BambooToken |
| Discovered by | Lumen Black Lotus Labs |
| Public disclosure | September 18-19, 2026 |
| Estimated active since | At least February 2023 |
| C2 channel | MQTT broker-routed messaging |
| Delivery method | DLL sideloading via Tendyron OnKey software |
| Platforms affected | Windows and Linux |
| Confirmed victims | ~12 organizations across Asia and South America |
| Sectors hit | Hotels, biomedical, law firms, finance, cryptocurrency |
| Notable compromise | GitLab server in Hong Kong |
The China-Nexus Attribution: What the Evidence Shows
Lumen’s analysts point to two technical indicators supporting a China-nexus assessment rather than a confirmed attribution to a named group. First, the DLL sideloading technique itself, abusing a legitimate signed application to load malicious code, is a tradecraft pattern long associated with China-aligned intrusion sets. Second, researchers observed a SoftEther VPN connection originating from a virtual private server that linked back to one of the malware’s command-and-control nodes, a network fingerprint consistent with infrastructure patterns seen in prior China-nexus campaigns.
Neither indicator alone proves attribution beyond doubt, and Lumen’s public reporting stops short of naming a specific state-linked group. That caution is typical of solid threat-intelligence work: infrastructure overlaps and tradecraft similarities build a probabilistic case rather than a courtroom-grade one. Still, the pattern fits a broader 2026 trend of East Asian-linked operators favoring stealthy, long-dwell-time intrusions over the smash-and-grab approach typical of financially motivated ransomware crews, a contrast visible when comparing BambooToken to the FudModule rootkit campaign tied to Lazarus Group activity disclosed earlier this year, which relied on kernel-level stealth rather than protocol abuse to stay hidden.
Cross-Platform by Design: Windows and Linux Targeting
BambooToken’s operators built versions of the malware for both Windows and Linux systems, a decision that widens the pool of viable targets considerably. Enterprise environments increasingly run mixed fleets, Windows on employee workstations and management servers, Linux on infrastructure, application backends, and DevOps tooling like the compromised GitLab server in Hong Kong. A single malware family capable of operating across both operating systems lets an operator move laterally from an initial Windows foothold into Linux-hosted infrastructure, or vice versa, without needing to develop or acquire a second, unrelated toolset.
That cross-platform capability, paired with the modular design Lumen describes, where an initial loader establishes access and pulls additional components down over the MQTT channel, gives BambooToken’s operators significant operational flexibility. They can tailor second-stage payloads per victim without redesigning the initial compromise mechanism each time.
How BambooToken Compares to Other 2026 Stealth Campaigns
2026 has produced a steady stream of long-dwell-time intrusion disclosures, and BambooToken fits a pattern rather than standing apart from it. Where FudModule relied on a kernel-level rootkit to hide from endpoint detection, and where Iran-linked CHOSEN BRICK spyware, covered in Tech Insider’s reporting on the campaign hitting three nations since 2023, focused on messaging-app surveillance, BambooToken’s innovation is protocol-level: it hides not by evading the endpoint agent directly, but by choosing a network channel most tooling was never built to inspect closely.
| Campaign | Primary Evasion Technique | Confirmed Duration | Attribution |
|---|---|---|---|
| BambooToken | MQTT-based C2 + DLL sideloading | Since at least Feb 2023 | China-nexus (assessed, not confirmed) |
| FudModule rootkit | Kernel-level rootkit persistence | ~5 weeks (2026 campaign) | Lazarus Group-linked |
| CHOSEN BRICK spyware | Messaging-app compromise | Since 2023, 3 nations | Iran-linked |
The common thread across all three is dwell time. None of these campaigns were smash-and-grab operations. Each was built to persist quietly for months or years, gathering access and intelligence rather than triggering the kind of immediate, visible disruption that a ransomware deployment would create. That distinction matters for how defenders prioritize monitoring: ransomware-focused detection tuned for encryption behavior and mass file changes will miss an operator whose entire playbook is staying quiet.
The Enterprise IoT Blind Spot This Campaign Exposes
BambooToken’s real significance for the security industry isn’t the dozen confirmed victims. It’s the protocol choice. MQTT traffic has exploded across enterprise networks over the past several years as smart building systems, industrial control integrations, and IoT telemetry platforms have proliferated, often deployed by facilities or operations teams with limited coordination with the security organization. Most network detection and response tooling, and most SIEM correlation rules, were built around the assumption that C2 traffic rides HTTP, HTTPS, DNS, or occasionally raw TCP, not a broker-routed IoT messaging protocol.
That gap is exactly what BambooToken’s operators exploited for more than three years. Security teams running mixed IT/OT environments, common in hospitality, biomedical, financial, and manufacturing sectors, the same industries represented among BambooToken’s confirmed victims, are the most exposed until detection tooling catches up with protocol-aware inspection for MQTT brokers and topic traffic.
What Security Teams Should Do Now
Lumen’s disclosure included indicators of compromise and specific detection guidance for defenders. The practical starting point for most enterprise security teams is visibility: most organizations currently have little to no logging or inspection coverage over MQTT broker traffic, which means the first step isn’t blocking, it’s simply gaining the ability to see what’s flowing over port 1883 or 8883 in the first place.
# Baseline discovery: identify MQTT brokers and traffic on the network
# Run from a network vantage point with visibility into internal traffic
# 1. Identify hosts communicating on standard MQTT ports
tcpdump -i any 'port 1883 or port 8883' -w mqtt_baseline.pcap
# 2. Enumerate discovered brokers and connected clients (requires broker access)
mosquitto_sub -h -t '#' -v
# 3. Flag unexpected sideloaded DLLs alongside signed executables (Windows)
Get-ChildItem -Recurse -Include *.dll -Path "C:Program Files" |
Where-Object { (Get-AuthenticodeSignature $_.FullName).Status -ne "Valid" }Beyond MQTT-specific monitoring, organizations running third-party signed software, particularly identity, authentication, or endpoint-agent products like Tendyron’s OnKey, should audit which DLLs load alongside those executables and confirm they match expected, signed originals. Security teams already stretched thin managing this year’s parade of critical infrastructure warnings, including the CISA-flagged bugs covered in Tech Insider’s reporting on the Citrix NetScaler vulnerability that left roughly 22,000 instances exposed and the Vidar 2.0 malware surge hitting gaming platforms, now have another category to fold into monitoring: IoT and OT-adjacent protocols riding on the same enterprise network as everything else.
Market Impact: A Growing Case for Protocol-Aware Detection Tools
BambooToken’s disclosure adds momentum to a detection-tooling category that has been growing steadily through 2026: network products built specifically to inspect IoT and OT protocol traffic rather than treating it as background noise. Lumen’s own business, as a network and telecom provider running threat intelligence out of Black Lotus Labs, sits at a natural vantage point to spot this kind of traffic-layer abuse precisely because it operates infrastructure that IoT and MQTT traffic actually transits.
For enterprise buyers, the practical takeaway is that network detection and response platforms marketed as full-coverage increasingly need to prove protocol-aware inspection beyond the traditional web and DNS layers. A vendor’s ability to parse and baseline MQTT, CoAP, and similar IoT-native protocols is becoming a genuine differentiator rather than a niche feature, particularly for organizations in hospitality, healthcare, biomedical, and financial services, the sectors BambooToken’s operators already proved they know how to target.
Historical Context: Sideloading and Broker-Based C2 Aren’t New, But This Combination Is
DLL sideloading has been a known technique for well over a decade, and MQTT-based malware C2 has surfaced in isolated proof-of-concept research and a handful of IoT-focused botnets in past years. What makes BambooToken notable is the combination, and the discipline. An operator patient enough to run undetected for three-plus years, refining both the delivery mechanism and the C2 channel in tandem between 2024 and 2025, was not relying on either technique alone. That level of operational patience is more commonly associated with state-aligned espionage operations than financially motivated crime, reinforcing the China-nexus assessment even without a confirmed named-group attribution.
What Comes Next: Five Predictions
- More MQTT-based malware families will surface through 2027. Once one threat-intel team documents a successful technique, other operators and researchers typically follow, either adopting the method or specifically hunting for it.
- Network detection vendors will fast-track IoT protocol coverage. Expect NDR and SIEM vendors to publicize new MQTT, CoAP, and broker-traffic inspection capabilities within the next two to three quarters as a direct response to this disclosure.
- Tendyron and similar authentication software vendors will face scrutiny over sideloading resistance. Signed software used broadly in enterprise identity workflows is likely to see increased code-signing and DLL-search-order hardening requirements.
- Additional BambooToken victims will be identified. Twelve confirmed organizations across a three-year campaign is almost certainly an undercount, given how limited most enterprises’ MQTT visibility currently is.
- Attribution will firm up over time. As more infrastructure and tradecraft overlaps surface, expect the China-nexus assessment to either solidify into a named group attribution or get folded into an existing tracked threat cluster within the next six to twelve months.
Frequently Asked Questions
What is BambooToken malware?
BambooToken is a malware family disclosed by Lumen’s Black Lotus Labs on September 18-19, 2026, that uses the MQTT messaging protocol for command-and-control communications and DLL sideloading through legitimate signed software to infect Windows and Linux systems while evading detection.
How long has BambooToken been active?
Lumen assesses the campaign has been running since at least February 2023, based on technical artifacts and samples, meaning it operated undetected for roughly three and a half years before public disclosure.
Who is behind BambooToken?
Lumen has not named a specific group but assesses the operation as China-nexus based on the use of DLL sideloading tradecraft and a SoftEther VPN connection from a VPS linking to one of the malware’s command-and-control nodes, patterns consistent with prior China-aligned campaigns.
Why does BambooToken use MQTT instead of normal C2 channels?
MQTT is a lightweight, broker-routed messaging protocol built for IoT and industrial telemetry. Because most enterprise security tools focus inspection on HTTP, HTTPS, and DNS traffic, MQTT-based command-and-control blends into legitimate sensor and device traffic and draws far less scrutiny.
How does the DLL sideloading component work?
The Windows variant sideloads a malicious library, OnKeyToken_KEB.dll, into the legitimate, digitally signed OnKeySrv.exe process from Tendyron’s OnKey software, letting the malware load through a trusted, signed executable rather than running as a standalone suspicious binary.
Which organizations were affected?
Lumen’s telemetry identified roughly a dozen compromised organizations across Asia and South America, spanning hotels, biomedical firms, law firms, a financial organization, a cryptocurrency-related website in Lithuania, and a GitLab server in Hong Kong.
Why is the compromised GitLab server significant?
A compromised source-control or CI/CD server is a classic supply-chain pivot point. Lumen’s report specifically flags the Hong Kong GitLab compromise as creating a potential foothold for downstream supply-chain attacks affecting code or systems that depend on that server.
How can organizations detect BambooToken or similar MQTT-based malware?
Start by gaining visibility into MQTT broker traffic on standard ports (1883 and 8883), since most organizations currently have little to no logging coverage there. Lumen also published specific indicators of compromise, and security teams should audit DLLs loading alongside trusted signed executables, particularly identity and authentication software.
