[
 {
  "value": "bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e",
  "type": "sha256",
  "first_seen": "2026-09-22",
  "last_seen": "2026-09-22",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "inside-bambootoken-s-linux-implant-shell-and-file-control-over-m"
  ],
  "sources": [
   "https://cyberpress.org/bambootoken-linux-mqtt-backdoor/"
  ],
  "reason": "BambooToken Linux MQTT implant payload hash"
 }
]