BambooToken Malware Uses MQTT to Control Windows and Linux Systems

Cybersecurity researchers have uncovered a multi-platform malware campaign leveraging the MQTT protocol as a covert command-and-control communication channel. The malware family, dubbed BambooToken, targets both Windows and Linux systems. Active since at least February 2023, the campaign has been observed targeting organizations across Asia and South America. MQTT, typically used in IoT and lightweight messaging scenarios, is being abused to blend malicious traffic with legitimate network communications. The use of MQTT as a C2 channel represents an emerging evasion technique that may bypass traditional network security controls. The campaign's cross-platform capability indicates a sophisticated threat actor with resources to develop and maintain malware for multiple operating systems.