C2 Went Pub/Sub, and Your MQTT Broker Is the Receipt

The most interesting line in Lumen's writeup on the BambooToken malware campaign isn't the malware. It's the plumbing. A family that's been quietly running since at least 2023 now does its command-and-control over MQTT — the lightweight publish/subscribe protocol most of us know as the thing keeping our smart home from shouting over the WiFi. Instead of a compromised server phoning home to an attacker-controlled IP, each infected host just subscribes to a broker topic keyed to a unique identifier, publishes status and system info to it, and waits. The operator publishes a command to that same topic, the agent picks it up, and runs. No direct connection to attacker infrastructure at all — Lumen calls the broker effectively a banana stand, a neutral storefront where the two sides exchange notes without ever meeting.

That's the part worth sitting with, because it quietly breaks the detection habit we've all built. Your egress monitoring and blocklists are keyed on the assumption that a malicious C2 has to *somewhere* to talk to — an IP you can sinkhole, a domain you can poison. Pub/sub C2 strips that out. The infected box is just chatting with a broker it might plausibly talk to, and MQTT chatter is exactly the kind of low-and-slow, async, fire-and-forget traffic that looks unremarkable on a wire. And it's resilient by design: if the network hiccups, nothing breaks, because there's no persistent session to tear down. If you run MQTT — home automation, industrial sensors, any self-hosted Linux box with a Mosquitto broker in it — the threat model has shifted. You can't just watch for the bad IP anymore. You have to start asking whether the *volume and destinations* of broker traffic coming off a given host is normal for it, which is a meaningfully harder thing to alert on.

The delivery is worth a look, too, because it's a good reminder that ‘signed binary’ is not the same as ‘trusted binary.’ The Windows agent got side-loaded through a digitally signed Tendyron OnKey USB-token installer — software that's popular in Chinese banking and government networks — or by impersonating the Kingsoft Office suite. A legitimate-looking, properly signed package is the trojan horse, which is why your perimeter scanner won't catch it. Lumen found a Linux variant (v2.1) that's MQTT-capable, can spawn a shell, and moves files both ways, though they're honest that it still looked under development. The hit list runs about a dozen enterprise victims across Asia and South America — hotels, law firms, a financial org, a Lithuanian crypto site — mostly the backend servers for mobile apps, plus a GitLab server in Hong Kong that's a supply-chain foothold waiting to happen. Lumen hasn't named a specific actor but calls the patterns consistent with China-aligned operations, and they've published IoCs if you want to go hunting.

Source image 1

The broader read: pub/sub is winning as C2 architecture, and every protocol that's already trusted on your network gets promoted from ‘just a bus’ to ‘potential control plane’ overnight. When you're designing a home lab or a production broker topology, this is a reason to treat the broker itself as a security boundary — authenticate who's publishing, log topics, and don't assume the traffic on your bus is the traffic you'd expect. If you're running MQTT brokers in production, how are you actually telling normal bus chatter apart from an exfil channel? I've got a feeling most of us aren't, yet.

Sources

• Lumen Black Lotus Labs — The banana stand: brokering and managing infections across Asia using MQTT
• BleepingComputer — BambooToken malware controls Windows and Linux systems via MQTT