A newly discovered Linux backdoor named BambooToken uses the MQTT messaging protocol as its command-and-control (C2) channel to gather host data, execute shell commands, and exfiltrate files from compromised systems.
Commonly used in IoT and connected-device environments, MQTT relies on a broker to relay messages—and BambooToken leverages that to stay one step removed from its operator. Researchers found this backdoor by decoding a compact embedded configuration and analyzing its MQTT callback behavior.
How BambooToken Operates
Once active on a Linux host, BambooToken starts by decoding a 59-byte configuration blob. This reveals the address of an MQTT broker and a fixed group topic. For process identity, it crafts a UUID-like client identifier. The malware then connects to the specified broker over TCP port 2883, retrying every 15 seconds on failure. To help maintain stealth and situational awareness, it registers an “offline” status message that may signal when the device is unreachable.
Its communication pattern uses a publish/subscribe model. Messages arrive under the group topic, the individual client ID, and additional topics. Handlers are divided between processing shell commands and handling files. To obscure behaviour, both topic names and payloads are encoded using a repeating XOR operation—effective at hiding content from cursory inspection, though not particularly strong cryptographically.
Capabilities: Shell and File Management, Reconnaissance
For command execution, BambooToken accepts JSON payloads containing a “command” field. These commands are executed through /bin/sh -c, with output streamed in 1,024-byte chunks back to the operator. Notably, each command is isolated rather than creating a persistent interactive shell.
The file management side supports directory listing, downloading files, uploading content, and deleting standard files. Downloads are sent in 128-KiB chunks, prefaced by a JSON header separated from the raw file data by a NUL byte. Directory listings include an anomalous field named “flies”—likely a typo for “files”—alongside names, types, sizes, and timestamps. BambooToken also supports gathering host inventory data—including username, hostname, OS release, network interfaces, processor model, and machine-ID (from /etc/machine-id or a fallback path under /var/lib/myapp).
Detection, Indicators & Defensive Measures
The backdoor’s embedded Indicators of Compromise (IoCs) include its ELF sample hashes: SHA-256, SHA-1, MD5, GNU Build ID, as well as network artifact details like the broker domain live-hk[.]c2iznja[.]com, its IP resolution, and the use of TCP port 2883. Also present are specific MQTT topics (both fixed group topic and encoded command topics such as “ONLINE”, “OFFLINE”, “/Shell”, “/File”, “/Resp”).
Detection strategies should include scanning for ELF binaries connecting to known broker addresses and unexpected child /bin/sh -c processes, unusual path usage like Windows-style timestamps or path separators, and review of MQTT traffic for encoded topic names or the odd “flies” field. Restricting outbound MQTT to trusted destinations, maintaining broker connection logs, enabling network packet captures, and isolating suspicious hosts before analysis are recommended defenses.
At present, it’s unclear how BambooToken first infects systems—its delivery vector, operator identity, and campaign attribution remain unknown. The broker domain embedded appears to be historic; current infrastructure reachability should be verified rather than presumed.
IoCs at a glance:
- ELF hashes: SHA-256
bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926, SHA-1, MD5, BuildID. - Broker domain & IP:
live-hk[.]c2iznja[.]com,202.144.192[.]149. - Port: TCP/2883.
- Embedded group topic:
{534E19D5-434B-4cad-A0C2-8D75E0B2FBFC}. - Encoded MQTT topic names for actions like “ONLINE”, “OFFLINE”, “/Shell”, “/File”, “/Resp”.
The prevalence of lightweight backdoors like BambooToken underscores how resource-constrained protocols can be turned into powerful tools for attackers. If you’ve got Linux servers exposed to networks where MQTT is allowed, especially in IoT or edge computing environments, this is a wake-up call.
Analytical Perspective: BambooToken represents a growing trend: threat actors using legitimate, lightweight messaging protocols to move laterally and hide C2 channels. MQTT is rarely blocked or heavily monitored in many environments, making it an attractive vector. What matters now is how defenders adapt: policy changes to limit MQTT exposure, better anomaly detection on broker communication, and tighter forensic practices will be the line between containment and breach. Organizations should also track broker infrastructure evolution—just because a domain or IP is inactive today doesn’t mean it won’t be resurrected tomorrow.
