🔴 Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration

A Linux variant of the BambooToken backdoor uses MQTT as its command-and-control channel, enabling operators to profile compromised hosts, execute shell commands, and transfer files through broker-mediated topics.

Analysis of a statically linked x86-64 ELF sample shows that its configuration, task routing, and network payloads are obfuscated with separate XOR routines.

The examined sample, SHA-256 bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e, is a 2.4 MB stripped C++ executable.