Author: DigitalSpying Security Desk
Date: September 15, 2026
Executive Summary
In a newly uncovered long-term cyber espionage campaign spanning Asia and South America, threat intelligence researchers at Lumen Black Lotus Labs have exposed a stealthy multi-platform malware ecosystem dubbed BambooToken. As reported by The Hacker News and BleepingComputer, the threat operators have been operating undetected since at least February 2023, targeting government agencies, telecommunications providers, biomedical firms, financial entities, and developer environments.
The threat actor achieves evasion by sideloading payloads through legitimate binaries from Tendyron OnKey—a hardware-based USB Public Key Infrastructure (PKI) token software with more than 190 million units deployed across the financial and government sectors. Crucially, BambooToken breaks conventional command-and-control (C2) paradigms by utilizing the Message Queuing Telemetry Transport (MQTT) protocol, an asynchronous IoT messaging standard, enabling resilient, low-noise communication that blends into normal network telemetry.
Deep-Dive Technical Analysis
1. Delivery & Execution: Sideloading via PKI Token Middleware
Tendyron’s OnKey devices are widespread USB cryptographic smart tokens utilized for hardware-backed identity verification and transaction signing in high-security enterprise banking environments:
* DLL Sideloading Vector: Rather than compromising Tendyron’s code-signing keys or software supply chain, threat actors identified that the legitimate Tendyron background service executable (OnKeySrv.exe) loads its dynamic dependencies without enforcing absolute path validation.
* Rogue DLL Deployment: Adversaries plant a malicious replacement library named OnKeyToken_KEB.dll in local search directories. When OnKeySrv.exe executes, the trusted binary unwittingly loads the malicious code into its process space, bypassing standard Endpoint Detection and Response (EDR) execution heuristics.
* Multi-Platform Evolution: While early 2023 iterations relied on memory-allocated PowerShell stagers, subsequent builds transitioned to DLL sideloading on Windows and expanded to native Linux execution modules by late 2025, maintaining identical C2 logic across operating systems.
2. The MQTT Command-and-Control Architecture
The standout feature of the BambooToken ecosystem is its adoption of MQTT (Message Queuing Telemetry Transport) for remote command-and-control.
Component
Operational Logic
Protocol Selection
MQTT (TCP ports 1883/8883) is selected to bypass DPI rules that scrutinize standard HTTP/HTTPS traffic.
Host Communication
Compromised hosts publish system heartbeats and recon data to specific broker topics.
Asynchronous C2
The C2 server subscribes to host topics and publishes command payloads asynchronously, decoupling infrastructure from real-time connections.
Plugin Deployment
Core agents fetch external .DAT configs or hardcoded domains (chat5188[.]tk) to load in-memory modules.
C2 Command Capabilities
* Antivirus Interrogation: Uses WMI to enumerate security suites and exfiltrate status to api80.c2iznja[.]com.
* Dynamic Plugin Loading: Ability to load/unload specialized modules in real-time.
* Execution Control: Supports self-termination and session disconnection.
* Infrastructure Interaction: Can exfiltrate cellular telemetry and perform network tunneling via compromised edge routers (MikroTik/DrayTek).
3. Edge Router Infrastructure & Global Targeting Scope
Lumen Black Lotus Labs mapped the adversary's global footprint across commercial proxy services and compromised infrastructure:
* Proxy Layering via Cloudflare: Primary C2 domains were routed behind Cloudflare reverse proxies, with operational domains achieving high enough sustained traffic to rank among the top 500,000 domains on Cloudflare Radar.
* Compromised Edge Nodes: Analysis of active network nodes revealed communications routing through compromised MikroTik and DrayTek edge routers across Singapore, Cambodia, and Vietnam, serving as intermediate egress proxies.
* Victim Profiling & Intelligence Collection:
* Smart Devices & Telecommunications: Mobile application backend servers and smart device manufacturers in Vietnam (enabling lifestyle and geolocation tracking).
* DevOps Environments: Compromised GitLab servers hosted in Hong Kong, exposing source repositories and CI/CD secrets.
* Corporate Verticals: Biomedical research laboratories in Argentina, international legal firms in Chile, cryptocurrency platforms in Lithuania, and financial institutions in Malaysia.
Industry Impact & Threat Assessment
* Abuse of Industrial & IoT Protocols for Corporate Espionage: As defenders strengthen controls around HTTP, DNS, and TLS egress traffic, threat actors are migrating toward non-traditional application-layer protocols like MQTT, CoAP, and WebSockets.
* The Blindspot of Hardware Token Software: Organizations often grant implicit administrative trust and broad security exemptions to PKI smart token middleware and smart card drivers, creating high-value targets for sideloading and living-off-the-land attacks.
Actionable Recommendations & Threat Hunting Guide
1. Network Telemetry & MQTT Egress Filtering
* Audit Outbound MQTT Traffic: Restrict outbound connections over TCP ports 1883 (unencrypted MQTT) and 8883 (secure MQTT over TLS) strictly to verified enterprise IoT brokers.
* Deep Packet Inspection for Non-IoT Subnets: Alert on MQTT protocol handshakes (CONNECT, PUBLISH, SUBSCRIBE) originating from standard desktop workstations, financial terminal machines, or developer laptops.
2. DLL Sideloading Mitigation on PKI Middleware
* Enable DLL Search Order Hardening: Enforce Safe DLL Search Mode on Windows systems and configure application whitelisting (AppLocker or WDAC) to prevent unverified DLLs from loading in user-writable application paths.
* Audit Tendyron Software Installations: Ensure that Tendyron OnKey client packages are installed within protected directory structures (%ProgramFiles% with restricted write permissions) rather than user directories.
3. Threat Hunting & Endpoint Indicators
* Process Monitoring: Inspect endpoint telemetry for instances where OnKeySrv.exe initiates outbound network connections or invokes WMI queries (wmic.exe /namespace:\\root\SecurityCenter2 path AntiVirusProduct get *).
* Domain & IP Blocklisting: Monitor perimeter firewalls for communication with documented infrastructure: chat5188[.]tk, api80.c2iznja[.]com, and associated Cloudflare proxy nodes.
Sources and Reference Intelligence: Lumen Black Lotus Labs Threat Research, The Hacker News, BleepingComputer.