China-Aligned Actors Deploy BambooToken Malware Using MQTT Protocol

A previously unknown malware framework known as BambooToken has been identified targeting Windows and Linux systems across Asia, South America, Lithuania, and Hong Kong. The operation, attributed to China-aligned cyber actors, utilizes the Message Queuing Telemetry Transport (MQTT) protocol to establish command-and-control channels over compromised servers. Security researchers confirmed the discovery on Sept. 15, 2026.

BambooToken represents a significant shift in operational tactics by leveraging MQTT, a lightweight messaging protocol typically designed for Internet of Things devices and industrial automation, to manage malicious infrastructure. By repurposing this standard communication method, the malware framework bypasses traditional detection mechanisms that focus on common command-and-control ports. The campaign has successfully infiltrated servers supporting mobile applications, legal services firms, financial institutions, and software development companies.

The affected organizations span a diverse geographic footprint, with confirmed compromises in major economic hubs across Asia and South America, alongside specific incidents in Lithuania and the Hong Kong Special Administrative Region. The malware's ability to operate on both Windows and Linux operating systems suggests a versatile architecture designed to maximize reach within heterogeneous enterprise environments. Once installed, BambooToken maintains persistent access through MQTT brokers, allowing operators to issue commands and exfiltrate data while blending into legitimate network traffic.

The specific objectives behind the deployment of BambooToken remain unclear. While the malware's capabilities indicate potential for long-term espionage or data theft, no definitive evidence has been released regarding whether the actors are currently extracting sensitive information or preparing the infrastructure for future disruptive actions. The targeting of legal and financial sectors points toward a strategic interest in high-value intellectual property or proprietary transactional data.

Cybersecurity experts note that the use of MQTT in this context complicates incident response efforts, as standard firewall rules often permit the protocol to facilitate legitimate business operations. This ambiguity allows the malware to remain undetected for extended periods. As organizations scan their networks for indicators of compromise associated with BambooToken, the full scope of the infection and the extent of data exposure are still being assessed.

Questions remain regarding the timeline of the initial intrusion and whether other sectors beyond those currently identified have been breached. The attribution to China-aligned operations aligns with broader patterns of state-sponsored cyber activity, yet the specific motivation for this campaign has not been disclosed. As investigators work to map the command-and-control infrastructure, the potential for further lateral movement within targeted networks poses an ongoing risk to global digital security.