A new malware family is staying under the radar by piggybacking on the MQTT protocol—a lightweight messaging standard ubiquitous in IoT and industrial systems—to hide its command-and-control (C2) traffic. Research from Lumen's Black Lotus Labs details "BambooToken," a campaign that uses this trusted protocol as a covert channel to control infected Windows and Linux machines across Asia and other regions.
The key innovation lies in abusing MQTT's reputation for benign, machine-to-machine chatter. Designed for resource-constrained devices, MQTT is often overlooked by security tools focused on scrutinizing web traffic. This allows BambooToken's C2 communications to blend in with legitimate sensor and device telemetry, evading many conventional network monitoring solutions.
The attack chain combines this protocol abuse with another stealthy technique: initial access via DLL sideloading, where malicious code is executed by a trusted, legitimate application. This creates a multi-layered evasion strategy. The malware's ability to target both Windows and Linux platforms further indicates its adaptability across different environments.
This development underscores a growing trend among adversaries: moving C2 communications onto less-scrutinized, legitimate protocols as defenders harden monitoring of standard web channels like HTTP and HTTPS. The use of MQTT is particularly significant given its massive deployment in IoT ecosystems worldwide.
The incident dictates two urgent defensive actions for security teams. First, organizations must implement dedicated monitoring for MQTT traffic, establishing a baseline of normal activity and alerting on anomalies—such as unexpected connections originating from workstations or servers. Second, it reinforces the critical need for strict network segmentation of IoT and industrial systems. Isolating these devices on separate network zones can contain breaches and prevent compromised IoT hardware from becoming a pivot point for deeper network intrusion.
As threat actors continue to refine their stealth techniques, the BambooToken campaign highlights that visibility into IoT communication patterns is no longer a luxury but a foundational component of modern network defense.
一個新的惡意軟件家族正透過依附於MQTT協議——一種在物聯網及工業系統中無處不在的輕量級訊息標準——來隱匿其指令與控制（C2）通訊，從而避開偵測。Lumen旗下Black Lotus實驗室的研究詳述了「BambooToken」行動，該行動利用此受信任的協議作為隱蔽通道，用以控制亞洲及其他地區受感染的Windows與Linux機器。
關鍵創新在於利用MQTT因其無害的機器對機器通訊而建立的聲譽。MQTT專為資源有限的設備設計，常被專注於審查網絡流量的安全工具所忽視。這使得BambooToken的C2通訊能與合法的傳感器及設備遙測數據混雜，從而規避許多傳統網絡監控解決方案。
攻擊鏈結合此協議濫用與另一種隱蔽技術：透過DLL側載進行初始訪問，即由受信任的合法應用程式執行惡意代碼。這形成了一個多層規避策略。該惡意軟件能針對Windows及Linux平台發動攻擊，進一步顯示其在不同環境下的適應能力。
此發展凸顯了對手群體中一個日益增長的趨勢：隨着防禦方加強對HTTP及HTTPS等標準網絡通道的監控，攻擊者正將C2通訊轉移至較少受審查的合法協議上。鑑於MQTT在全球物聯網生態系統中的龐大部署量，其被使用具有特殊意義。
此事件要求安全團隊採取兩項緊急防禦行動。首先，組織必須對MQTT流量實施專用監控，建立正常活動基線，並就異常情況（例如源自工作站或伺服器的意外連接）發出警報。其次，這再次強調了對物聯網及工業系統實施嚴格網絡分段的關鍵必要性。將這些設備隔離於獨立的網絡區域，有助於遏制入侵，並防止被入侵的物聯網硬件成為更深入網絡滲透的跳板。
隨着威脅行為者持續精進其隱蔽技術，BambooToken行動突顯了一點：對物聯網通訊模式的可見性，已不再是奢侈，而是現代網絡防禦的基礎組成部分。