Loading story…
Researchers identified BambooToken, a previously undocumented cross-platform malware framework active since at least February 2023 and still operating as recently as July 2026. Its Windows and Linux variants use MQTT publish-subscribe infrastructure for command-and-control, allowing operators to conduct host reconnaissance, execute shells, and perform file operations. The malware evolved from a PowerShell in-memory execution stager into a DLL-side-loading payload, with Linux support appearing in late 2025.
The campaign compromised about a dozen organizations, predominantly in Asia and South America, including mobile-application backend servers and entities in the hotel, biomedical, legal, financial, and cryptocurrency sectors. Operators abused a DLL-side-loading-prone component of signed Tendyron OnKey USB-token software and also masqueraded as Kingsoft Office; researchers found no evidence that Tendyron's signing certificate or build environment was compromised. Attribution remains unconfirmed, though Chinese upload IP space, China-focused targeting signals, SoftEther VPN infrastructure, and tradecraft are consistent with a possible China-aligned actor.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
BambooToken-related activity was observed as recently as July 2026.
Lumen Technologies Black Lotus Labs discovered BambooToken samples on VirusTotal in early 2026.
In December 2025, operators introduced Linux targeting while retaining MQTT C2. The observed Linux BambooToken 2.1 sample performed reconnaissance, shell execution, and file upload, download, and deletion operations, though researchers assessed it was still under development.
Lumen Black Lotus Labs assessed that the BambooToken campaign had been active since at least February 2023.
Lumen could not attribute BambooToken to a known actor, but assessed its targeting and infrastructure as consistent with a possible China nexus. The researchers found no evidence of an operational link to Mustang Panda or its MQsTTang backdoor.
Lumen identified roughly a dozen compromised organizations, primarily in Asia and South America, including a Hong Kong GitLab server and entities in the hotel, biomedical, legal, financial, and cryptocurrency sectors. Most affected servers supported mobile applications, and Lumen shared associated indicators of compromise.
Later BambooToken versions used the Tendyron OnKeySrv program to sideload a malicious OnKeyToken_KEB.dll and used MQTT in their command-and-control loop. BambooToken variants developed during 2024–2025 supported Windows and Linux hosts via MQTT communications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
mkd-cirt.mk
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **Showboat**, a previously unreported modular Linux malware framework used since at least mid-2022 to compromise telecommunications organizations in the Middle East, Asia Pacific, and other regions. Black Lotus Labs said the malware operates as a post-exploitation backdoor that enables remote shell access, file transfer, host reconnaissance, persistence, process hiding, port mapping, and **SOCKS5 proxying**, allowing attackers to maintain access and pivot into internal systems not exposed to the internet. Investigators said the malware stayed largely undetected for months after a 2025 sample submission, highlighting the stealth of Linux-focused intrusions against telecom infrastructure. Infrastructure and victimology linked the activity with moderate confidence to one or more **China-aligned threat clusters**, with command-and-control nodes and related IP activity tied to **Chengdu, Sichuan**, and domains impersonating telecom brands in Southeast Asia. Reporting also connected the broader campaign to the deployment of a Windows implant, **JFMBackdoor**, through DLL sideloading, suggesting a cross-platform espionage operation against telecom providers. Confirmed or suspected victims included a telecom provider in the Middle East, an ISP in Afghanistan, entities in Azerbaijan, and networks in the United States, Ukraine, and the Donbas region, reinforcing concerns that shared malware tooling is being used across multiple PRC-linked operations.
Jun 29, 2026
Security researchers reported multiple campaigns using trojanized versions of **PuTTY** and other legitimate tools to compromise high-value users, including administrators, engineers, and technical support staff. LevelBlue said a recent malvertising operation pushed fake PuTTY installers through **Bing sponsored ads** and typosquatted domains such as `puttyy[.]org` and `puttysystems[.]com`, with a signed malicious executable creating scheduled-task persistence, dropping `twain_96.dll` and `green.dll`, and communicating with infrastructure linked to **Broomstick/Oyster** malware. In affected environments, the intrusions progressed to hands-on-keyboard activity, reconnaissance via `cmd.exe`, and **Kerberoasting** using an in-memory script derived from PowerSploit’s `Invoke-Kerberoast` to obtain RC4-HMAC Kerberos service tickets for offline cracking. Microsoft previously described a related tradecraft pattern in which North Korean state-backed **ZINC**—now tracked as **Diamond Sleet**—used social engineering on LinkedIn and WhatsApp to deliver weaponized open-source software, including **PuTTY**, **KiTTY**, **TightVNC Viewer**, **Sumatra PDF Reader**, and **muPDF**, to targets in media, defense, aerospace, and IT services across several countries. That activity deployed the **ZetaNile** malware family using DLL search-order hijacking, staged payloads, persistence, lateral movement, and data exfiltration, while separate analysis of Lazarus-linked **BLINDINGCAN** showed the group’s broader capability set for encrypted command-and-control, remote command execution, file transfer, and system discovery. Together, the reporting shows attackers repeatedly abusing trusted admin and open-source tools as malware delivery vehicles to gain persistence, steal credentials, and expand access inside victim networks.
Aug 15, 2026
China-linked espionage group **BlackTech**—also tracked as **Earth Hundun**, **Palmerworm**, and **Red Djinn**—was tied to sustained intrusions across East Asia, with a heavy focus on Taiwan and Japan and victims spanning government, media, telecommunications, defense, academia, technology, semiconductors, manufacturing, and professional services. Reporting describes spearphishing campaigns using password-protected archives and malicious Excel macro files, alongside exploitation of internet-facing systems including **ProxyLogon**, `CVE-2015-5119`, and `CVE-2017-7269`, to gain initial access. In Japanese campaigns, researchers linked tools including **Flagpro**, **BTSDoor**, **LAMICE**, **BUSYICE**, **TELESWORD**, **DELTABEEF**, **SELFMAKE**, and **SPIDERPIG** to the actor, while earlier operations used **PLEAD**, **DRIGO**, **Waterbear**, and **Shrouded Crossbow** malware built around **BIFROST/BIFROSE**, **KIVARS**, and **XBOW** variants. Researchers said BlackTech used modular, multi-stage malware to steal credentials, profile hosts, maintain persistence, and exfiltrate sensitive documents, including government, defense, budget, and foreign-affairs material. **Flagpro** was described as an early-stage downloader and credential stealer that could fetch second-stage payloads such as **BTSDoor**, while **Waterbear** operated as an in-memory backdoor and **DRIGO** exfiltrated data through Google services; separate analysis also identified a Linux **ELF Bifrose** variant, showing the group’s tooling extends beyond Windows. Investigations further uncovered exposed directories and overlapping command-and-control infrastructure tied to BlackTech, including malware controllers and exploit collections for routers, Citrix, MikroTik, VMware vRealize, Cisco RV devices, Hongdian routers, and Oracle WebLogic, while domain-tracking research showed the actor repeatedly reused registrant details, name servers, and tech-themed domains even as registrar choices shifted over time.
Aug 15, 2026