#ParsedReport #CompletenessHigh
18-09-2026

The banana stand: brokering and managing infections across Asia using MQTT

https://www.lumen.com/blog/en-us/the-banana-stand-brokering-and-managing-infections-across-asia-using-mqtt

Report completeness: High

Actors/Campaigns:
Volt_typhoon
Ghostemperor

Threats:
Bambootoken
Supply_chain_technique
Zuo_rat
Iocontrol
Plugx_rat
Wikiloader

Victims:
Mobile application backend servers, Gitlab server, Software development company, Hotel, Biomedical company, Legal firm, Cryptocurrency website, Finance organization, Mikrotik routers, Draytek routers, have more...

Industry:
Biotechnology, Software_development, Government, Financial, Entertainment

Geo:
Lithuania, Singapore, Malaysian, Chile, Vietnam, Vietnamese, Argentina, Chinese, China, Cambodia, Hong kong, America, Malaysia, Japan, Latin america, Asia

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027, T1036, T1047, T1055, T1059.004, T1070.004, T1071, T1071.001, T1082, T1090, have more...

IOCs:
File: 7
Domain: 14
Url: 1
IP: 8
Hash: 7

Soft:
Linux s, Linux, Mosquitto, Visual Studio, Component Object Model, curl

Algorithms:
sha256, aes, zip, xor

Languages:
lua

Platforms:
x64

Links:
https://github.com/eclipse-mosquitto/mosquitto/tree/master
https://github.com/blacklotuslabs/IOCs/blob/main/Banana\_Stand\_IOCs.txt