Reported by 3 outlets
BambooToken Linux implant uses MQTT for shell and file control
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.25 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
BambooToken's Linux implant uses MQTT for C2, enabling remote shell execution and file exfiltration. The statically linked x86-64 ELF uses XOR-obfuscated configuration and task routing. No CVE assigned; threat is active backdoor behavior, not a vulnerability patch. Watch for MQTT broker indicators and similar statically linked ELF samples on Linux endpoints.
Timeline
-
original reporting
Inside BambooToken’s Linux implant: shell and file control over MQTT
app.reverser.space · 22d ago · September 21st, 2026
submitted by /u/420ass_slayer69 [link] [comments]
via reddit r/cybersecurity: Inside BambooToken’s Linux implant: shell and file control over MQTT
-
update from cyberpress.org
BambooToken Linux Malware Uses MQTT to Run Shell Commands and Steal Files
cyberpress.org · 21d ago · September 22nd, 2026
Researchers have analyzed a Linux malware sample identified as BambooToken, a backdoor that uses the MQTT messaging protocol for command-and-control (C2) communications. The malware can collect system information, execute shell commands, browse files, upload data, and steal files from compromised Linux machines . The analyzed sample is a stripped, statically linked 64-bit Linux ELF file with the SHA-256 hash bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e . Its hash is listed in Black Lotus Labs’ published BambooToken Linux indicators, supporting the malware-family attribution. However, the available evidence does not independently identify the operator behind the activity. BambooToken contains an encrypted 59-byte configuration blob that reveals its MQTT infrastructure after decoding. The malware uses a single-byte XOR key to recover the broker hostname live-hk[.]c2iznja[.]com and a hard-coded group topic, {534E19D5-434B-4cad-A0C2-8D75E0B2FBFC} . BambooToken Linux MQTT Backdoor The malware connects to the MQTT broker over TCP port 2883. It creates a new UUID-like client identifier during execution, allowing the attacker to communicate with each infected system through a distinct MQTT topic. If the connection fails, BambooToken waits 15 seconds before retrying. The malware can also run in the background using a double-fork daemonization routine. This detaches it from the terminal, changes its working directory to / , and sets its file-creation mask to zero.
-
update from gbhackers.com
Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration
gbhackers.com · 21d ago · September 22nd, 2026
A Linux variant of the BambooToken backdoor uses MQTT as its command-and-control channel, enabling operators to profile compromised hosts, execute shell commands, and transfer files through broker-mediated topics. Analysis of a statically linked x86-64 ELF sample shows that its configuration, task routing, and network payloads are obfuscated with separate XOR routines. The examined sample, SHA-256 […] The post Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .