BambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files

BambooToken is a Linux backdoor that turns a lightweight messaging protocol into a remote control channel. The newly analysed sample can collect information about a host, run shell commands, and move files between a compromised machine and its operator.

Its use of MQTT is notable because the protocol is common in connected-device environments and uses a broker to relay messages.

Reverser analysts identified the implant after decoding a small embedded configuration block and tracing its MQTT callbacks.

Reverser said in a report shared with Cyber Security News (CSN) that the sample contains a host inventory collector, a command worker, and a file manager connected through encoded MQTT topics.

The analysis does not establish initial access, delivery method, an operator, or a victim campaign. Once placed on a Linux system, however, the backdoor could give an intruder practical access to system details, command output, and locally stored data.

BambooToken Linux Backdoor Uses MQTT C2

At launch, BambooToken decodes a 59-byte configuration blob to recover an MQTT broker address and a fixed group topic. It then creates a UUID-like client identifier for the running process.

The program connects to its configured broker over TCP port 2883 and retries after failures with a 15-second delay. It also registers an offline status message, a feature that can help track an infected system.

The control client listens for messages on the group topic, its client identifier, and several additional topic names. Separate workers handle shell and file requests.

This publish-and-subscribe design resembles techniques discussed in reporting on MQTT messaging protocol abuse, where a broker can separate the attacker from the directly managed endpoint.

BambooToken hides both its payloads and topic labels with a repeating XOR operation. The encoding can make quick inspection harder, but offers no strong protection once the key is known. Analysts should treat unusual MQTT sessions from Linux servers as a lead rather than proof of compromise.

A shell request accepts JSON carrying an operation named command and passes the supplied text to the system shell through /bin/sh -c. Output is read in 1,024-byte lines and returned to the controller. Each request launches a separate command, rather than creating a persistent interactive terminal.

This capability gives an intruder a flexible way to inspect the system, collect results, or prepare later actions. It also underlines why defenders investigating suspicious command execution should examine network context, a pattern also seen in remote MQTT control malware.

File Control and Detection

The file component can list directories, download files from the victim, upload content, and delete regular files. Downloaded data is sent in 128-KiB chunks, with a JSON header separated from the raw file bytes by a NUL character.

A parser that expects an entirely JSON message could miss the transferred content. Directory listings contain a misspelled field, flies, alongside file names, types, sizes, and timestamps. That unusual protocol detail may help analysts recognize decoded traffic.

The sample also adjusts Windows-style paths and uses Windows-style time values, suggesting compatibility with a management design that may have originated elsewhere.

When it receives an ONLINE request, BambooToken gathers the username, hostname, operating-system release, machine identifier, network details, processor model, and process information.

It tries /etc/machine-id first and can fall back to a path under /var/lib/myapp, which may offer a useful correlation point during an investigation.

Defenders should hunt for unfamiliar Linux ELF files that connect to the listed broker or historical address on port 2883, then correlate those events with child /bin/sh -c processes and unexpected file access.

Encoded MQTT topics, the flies field, and data split at a NUL byte can strengthen a detection. Similar backdoor activity has appeared in coverage of MQTT enabled malware operations, but port use alone remains weak evidence.

Organizations should restrict unnecessary outbound MQTT traffic, log broker connections, preserve relevant network captures, and isolate suspected hosts before collecting volatile evidence.

Since the reported address is historical, responders should validate current resolution and connectivity rather than assuming the infrastructure is still active.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post BambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files appeared first on Cyber Security News.