BambooToken malware controls Windows and Linux systems via MQTT
Summary
A new malware framework named BambooToken has been identified, operating since at least 2023. This framework utilizes the MQTT protocol for command and control, enabling it to manage both Windows and Linux systems.
IFF Assessment
FOE
The discovery of a new malware framework that can control both Windows and Linux systems represents a significant threat to defenders.
Defender Context
The emergence of BambooToken highlights the evolving tactics of threat actors, who are increasingly leveraging versatile protocols like MQTT for malware communication. Defenders should be aware of MQTT traffic within their networks, especially if it deviates from expected patterns, as it could indicate C2 communication for compromised systems.