BambooToken Malware Uses MQTT to Control Windows and Linux Systems

Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America.

Report facts: The article describes BambooToken, a multi-platform malware family that uses the MQTT protocol as a command-and-control channel to remotely control compromised Windows and Linux systems in campaigns active since at least February 2023, targeting organizations in Asia and South America. RealGround analysis: While the campaign is not explicitly AI-driven, malware leveraging flexible messaging protocols like MQTT can be integrated into AI-powered attack tooling or used as infrastructure controlled by autonomous agents. Organizations adopting AI agents for operations should ensure their red-teaming programs model scenarios where agents interact with compromised infrastructure or abnormal MQTT-based C2 traffic, and reinforce segmentation and monitoring so AI-assisted operations cannot be co-opted by such malware.