Loading story…
Researchers analyzed BambooToken, a Linux backdoor that uses MQTT publish-and-subscribe messaging for command-and-control. The implant decodes an embedded 59-byte configuration blob to locate an MQTT broker, reportedly communicating over TCP port 2883; it obfuscates MQTT topics and payloads with hex encoding and a repeating XOR key.
BambooToken inventories compromised hosts, executes attacker commands through /bin/sh -c, and can list, upload, download, and delete files. Analysts identified a flies field in directory-listing responses and a file-transfer format that separates JSON metadata from raw file data with a NUL byte. The operator, delivery vector, affected victims, and associated campaign remain unidentified.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers analyzed BambooToken, a Linux ELF backdoor that uses an MQTT broker for command-and-control. The implant decodes an embedded configuration to reach its controller, obfuscates MQTT topics and payloads with repeating XOR, and provides host inventory, shell-command execution, and file-management functions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **BambooToken**, a previously undocumented cross-platform malware framework active since at least February 2023 and still operating as recently as July 2026. Its Windows and Linux variants use MQTT publish-subscribe infrastructure for command-and-control, allowing operators to conduct host reconnaissance, execute shells, and perform file operations. The malware evolved from a PowerShell in-memory execution stager into a DLL-side-loading payload, with Linux support appearing in late 2025. The campaign compromised about a dozen organizations, predominantly in Asia and South America, including mobile-application backend servers and entities in the hotel, biomedical, legal, financial, and cryptocurrency sectors. Operators abused a DLL-side-loading-prone component of signed Tendyron OnKey USB-token software and also masqueraded as Kingsoft Office; researchers found no evidence that Tendyron's signing certificate or build environment was compromised. Attribution remains unconfirmed, though Chinese upload IP space, China-focused targeting signals, SoftEther VPN infrastructure, and tradecraft are consistent with a possible China-aligned actor.
Sep 17, 2026
Elastic Security Labs identified **BITSLOTH**, a previously undocumented Windows backdoor deployed after lateral movement in an intrusion against a South American government’s Foreign Ministry. Attackers executed the payload through DLL side-loading using a signed FL Studio executable and used public tooling including RINGQ, IOX, STOWAWAY, GodPotato, Mimikatz, PPLFault, and Certify. BITSLOTH abuses the Windows **Background Intelligent Transfer Service (BITS)**—a legitimate Windows component commonly accessed through COM interfaces—for command-and-control communications, file transfers, and persistence. The backdoor can perform host discovery, execute commands, manage processes and services, capture screenshots, and log keystrokes, indicating an intelligence-collection objective. Development artifacts date to December 2021 and contain Simplified Chinese strings and terminology, although the responsible threat actor has not been identified.
Sep 9, 2026
Security researchers detailed **BPFDoor**, a stealthy Linux backdoor attributed by PwC to the China-linked group **Red Menshen**, describing its use in long-running intrusions against telecommunications, government, logistics, and education organizations in the Middle East and Asia. The malware is designed for covert re-entry and persistence, using raw sockets and **Berkeley Packet Filter (BPF)** logic to inspect network traffic for specially crafted magic packets, then launching a reverse shell, bind shell, or pingback without exposing obvious new listening services. Researchers said BPFDoor can hide behind legitimate network activity by listening on traffic destined for existing services such as `443`, allowing operators to execute commands while avoiding conspicuous firewall or port changes. Analysis showed the malware often copies itself into `/dev/shm`, deletes the original binary, spoofs process names, creates PID files under `/var/run`, and can temporarily alter `iptables` to hijack traffic for command and control; historical samples appeared functionally stable over time, with changes largely limited to hardcoded passwords, filenames, and process names. Elastic and other researchers published hunting guidance, YARA signatures, and tooling to help defenders identify infections.
Aug 15, 2026