CERT24BambooToken malware controls Windows and Linux systems via MQTTLoading data…
CERT24Threat Observatory
Period

BambooToken malware controls Windows and Linux systems via MQTT

The previously unknown BambooToken malware framework has been active since at least 2023 and uses the MQTT protocol for command-and-control communications with Windows and Linux systems in variants developed between 2024 and 2025. Lumen identified approximately a dozen compromised enterprise entities, mostly in Asia and South America.

← Back to intelligence

BambooToken malware controls Windows and Linux systems via MQTT

The previously unknown BambooToken malware framework has been active since at least 2023 and uses the MQTT protocol for command-and-control communications with Windows and Linux systems in variants developed between 2024 and 2025. Lumen identified approximately a dozen compromised enterprise entities, mostly in Asia and South America.