BambooToken is a previously undocumented, cross-platform espionage framework that Lumen's Black Lotus Labs surfaced from VirusTotal in early 2026 and detailed in its "Banana Stand" report. What sets it apart is the command channel: instead of beaconing straight to an attacker server, infected Windows and Linux hosts publish and subscribe through an MQTT broker, so a victim never holds a direct connection to operator infrastructure.
The implant reaches execution by side-loading a rogue DLL (OnKeyToken_KEB.dll) into Tendyron's legitimately Microsoft-signed OnKeySrv.exe PKI-token service. Black Lotus Labs traced activity back to February 2023, tracked a switch from HTTP to MQTT around 2024, observed a Linux variant in December 2025, and saw live infrastructure through July 2026. Roughly a dozen enterprises — plus around 150 small router networks — span mobile-app backends, a Hong Kong GitLab server, finance, legal, biomedical, hospitality and crypto across Asia and South America.
Attribution is unconfirmed, but the tradecraft — DLL side-loading, SoftEther VPN relays, Cloudflare fronting and targeting of overseas-Chinese users — is assessed as China-nexus. This brief breaks down the loader chain, the MQTT protocol, the plugin system and infrastructure, then gives copy-pasteable hunt queries and hardening steps.
◈ Table of Contents
01 · Threat Profile & Attribution
Phase 1 / 12BambooToken is a malware family, not a formally named group. Black Lotus Labs stops short of firm attribution but records several China-nexus indicators. Treat the profile below as an activity cluster, not a confirmed APT designation.
| Attribute | Detail |
|---|---|
| Family name | BambooToken (Black Lotus Labs designation) |
| Type | Modular, plugin-based backdoor / espionage framework |
| Platforms | Windows (v1–v2.1) and Linux (v2.1, Dec 2025) |
| First seen | February 2023 (HTTP C2); MQTT transition circa 2024 |
| Most recent activity | Live C2 infrastructure observed through July 2026 |
| Attribution confidence | Suspected China-nexus — LOW/MED |
| Attribution signals | DLL side-loading tradecraft, SoftEther VPN relays, targeting of overseas-Chinese users, PRC-aligned hosting |
| Targeting | Asia (China, SE Asia) and South America; ~12 enterprises + ~150 SOHO router networks |
| Researchers | Danny Adamitis & Steve Rudd, Lumen Black Lotus Labs |
Do not brand this as a specific named APT in your own reporting. The evidence supports a skilled, China-aligned operator but the vendor explicitly declined firm attribution. Track it as the "BambooToken" cluster.
02 · Campaign Timeline
Phase 2 / 12The family has evolved across at least three functional generations. The move from HTTP to MQTT and the addition of a Linux build are the two inflection points that matter operationally.
- 1Feb 2023 — v1. First samples use HTTP-based C2 with a hardcoded fallback domain and a PowerShell stager. Configuration decrypted from an
OnKeySrv.datprofile. - 22024 — v2.0. C2 migrates to the MQTT publish-subscribe model. The
chat5188[.]tkdomain climbs into Cloudflare Radar's top 1M (peak Dec 17, 2024), signalling a large install base. - 3Dec 2025 — v2.1. A Linux variant appears with expanded host enumeration; a mass SNMP scan of SOHO routers on Dec 15, 2025 stands up ~150 relay networks.
- 4Dec 28, 2025. The successor domain
c2iznja[.]comreaches Cloudflare Radar's top 500K — a second wave of widespread infection. - 5Jan–Jul 2026. Black Lotus Labs tracks live MQTT brokers on non-standard ports; the newest SoftEther relay is last-seen July 27, 2026.
03 · Initial Access & Victim Footprint
Phase 3 / 12Black Lotus Labs states the delivery vector for the enterprise implants remains undetermined. What is documented is the two-tier victim structure: a small set of high-value enterprises, and a larger pool of compromised routers repurposed as relay infrastructure.
Enterprise Implants (~12)
Mobile-app backend servers, a Hong Kong GitLab instance, a Vietnamese smartwatch software firm, a hotel, an Argentine biomedical company, a Chilean law firm, a Lithuanian crypto platform and a Malaysian finance org.
Router Relays (~150)
MikroTik and DrayTek SOHO routers reached via SNMP (UDP/161) during a Dec 15, 2025 scan window, geolocated to Singapore, Cambodia and Vietnam.
Diaspora Targeting
Router relays terminate through SpeedCN VPN into mainland China, consistent with surveillance of overseas-Chinese users reaching home services.
Sector Spread
Finance, legal, biomedical, hospitality, cryptocurrency and software development — a mix that points to intelligence collection rather than commodity crime.
The router tier matters for defenders even if you run no Tendyron software: BambooToken relays hide behind residential and SOHO IP space, so C2 traffic can arrive from an ISP range you would normally trust. Fingerprint on protocol and port, not geography.
04 · Technical Deep Dive — The Loader Chain
Phase 4 / 12The heart of BambooToken is a DLL side-loading chain that hijacks a legitimate, Microsoft-signed PKI-token service. Neither Tendyron's signing certificate nor its build environment was compromised — the operators simply exploit the way OnKeySrv.exe resolves and loads its companion DLL.
A trusted, signed OnKeySrv.exe (Tendyron Corp) loads the attacker's OnKeyToken_KEB.dll from its own directory. Because the host process carries a valid signature, allow-listing and reputation checks that trust the parent binary let the rogue DLL ride in.
- 1The legitimate
OnKeySrv.exestarts from a trusted path and resolves its companion DLL by name. - 2The malicious
OnKeyToken_KEB.dllis planted alongside it and loaded via the hijacked search flow, exporting the functions the host expects (OnKeyT_AppendEventInfor,OnKeyT_ContextInit). - 3An alternate variant masquerades under a "Zhuhai Kingsoft Office Software" identity whose signature fails validation — a fallback when the OnKey path is unavailable.
- 4The DLL performs remote-thread injection into the target process to run its payload in a trusted context.
EDR rules that trust a process solely because it is signed by "Tendyron Corp" will miss this. The signature belongs to the host EXE, not the sideloaded DLL. Validate module signatures, not just the parent image.
Configuration lives in an encrypted OnKeySrv.dat profile. The loader XOR-decodes it with a key reused across multiple v2.0/2.1 samples, then extracts C2 endpoints using distinctive text markers.
- 1XOR-decode the embedded GUID/mutex and the
.datcontents with the shared key. - 2Parse IPs between
&#/#&and domains between$@/@$to build the malleable C2 profile. - 3If
OnKeySrv.datis missing, use the hardcoded fallback endpoint and continue.
The operators actively obscure build provenance. Samples carry fake Windows Server 2003 / Visual Studio 2005 timestamps, and compile-time varies slightly per sample to break naive signatures.
- 1Anachronistic toolchain markers (VS 2005) disguise the true build environment.
- 2Missing
/OPT:REFand/Gylinker flags leave dead code and debug symbols behind — useful for capability discovery (see Phase 6). - 3Identical RichPE headers across 2024 and 2025 samples confirm a shared codebase and build machine, letting analysts cluster otherwise-varied binaries.
RichPE header correlation is your friend here. Even when timestamps and hashes drift, the Rich header often stays constant across a single developer's toolchain — pivot on it to find related samples in your malware repo.
05 · The MQTT C2 Protocol
Phase 5 / 12This is the family's signature trait. MQTT is a lightweight publish-subscribe protocol built for IoT telemetry. By routing C2 through a broker, BambooToken breaks the direct victim-to-operator link that most beaconing detections assume — the implant only ever talks to a broker, and the operator subscribes to the same topics from elsewhere.
The implant embeds an Eclipse Mosquitto-based MQTT client. Brokers were observed on both standard and deliberately non-standard ports, which is the cleanest network-level tell.
| Property | Value |
|---|---|
| Protocol | MQTT (publish-subscribe over TCP) |
| Client library | Eclipse Mosquitto (open source) |
| Standard ports | 1883 (plain), 8883 (TLS) |
| Non-standard ports | 2883, 63196, 63916, 64332 hunt |
| Timeout / retry | 60 s keep-alive; 15 s reconnect interval |
Each host computes a GUID and subscribes to per-device topics; the operator publishes tasking to those topics and to a shared Global broadcast channel. Status is a small JSON beacon.
MQTT rarely appears in enterprise egress outside of IoT/OT segments. A general-purpose workstation or server opening a long-lived MQTT session — especially on 2883/63916 — is anomalous on its own, before you even look at content.
06 · Plugin Architecture & Capabilities
Phase 6 / 12BambooToken is deliberately minimal at the core; capability arrives as plugins pushed over the {GUID}/Plugin topic. Black Lotus Labs confirmed a handful of live handlers and found extensive dead code hinting at planned surveillance features.
| Handler / Plugin | Function | Status |
|---|---|---|
| ONLINE | Heartbeat beacon with full host parameters | Active |
| SHELL | Spawns a command shell in a dedicated thread | Active |
| FILEEX | File download / upload / delete; process termination | Active |
| AV enumeration | WMI query every 5 s; exfil via GET to api80.c2iznja[.]com | Active |
| KEY_RECOURD [sic] | Keylogger | Dead code |
| COM_clipboard | Clipboard capture | Dead code |
| Audio / webcam / desktop | A/V and screen capture | Dead code |
The antivirus-discovery plugin polls installed security products via WMI and reports them out-of-band over HTTP with a distinctive user-agent — a strong, low-noise detection opportunity.
- Static, unusual user-agent string ("HTTP Downloader")
- AV product names leaking as URL path segments
- 5-second polling cadence is machine-regular, not human
The dead-code capabilities (keylog, clipboard, audio, webcam, screen) mean a future push over the plugin topic can turn a "quiet" implant into full surveillance without redeploying the loader. Treat any confirmed BambooToken host as fully compromised.
07 · C2 Infrastructure & Fingerprinting
Phase 7 / 12BambooToken runs two domain generations — the historical chat5188[.]tk and the current c2iznja[.]com — with overlapping IPs that let researchers link them. Cloudflare fronts several subdomains; a SoftEther VPN VPS relays traffic. The table below is the live broker set Black Lotus Labs tracked in 2026.
| C2 IP | Geo / ASN | Observed ports | Window (2026) |
|---|---|---|---|
| 202.144.192[.]23 | Japan / AS63916 | 1883, 2883, 63196 | Jan 20 – Apr 20 |
| 202.144.192[.]149 | Japan / AS63916 | 1883, 2883, 8883, 63916 | Jan 20 – Jul 2 |
| 210.1.226[.]238 | — | 8883, 63196 | Jan 20 – Jul 2 |
| 210.1.226[.]163 | — | 63916 | — |
| 210.1.231[.]13 | Malaysia / AS45785 | 443, 1883, 63916, 64332 | Jan 20 – Jul 2 |
| 43.245.198[.]195 | — | 1883, 63196 | Mar 3 – Jul 2 |
| 43.245.198[.]238 | — | 1883, 63196 | Jan 20 – Jul 2 |
| 38.180.150[.]19 | SoftEther VPS (HK) | relay → 202.144.192[.]149 | Mar 18 – Jul 27 |
Because the brokers speak MQTT on odd ports, internet-scan platforms make good pivots. Look for MQTT service banners on the non-standard ports and cross-reference the known ASNs.
Validate any hit before blocking — MQTT on 8883/1883 is legitimate in IoT deployments. It is the combination of odd ports (2883/63916), the specific ASNs, and short-lived broker lifetimes that distinguishes BambooToken infrastructure.
08 · Indicators of Compromise
Phase 8 / 12All IOCs below are drawn from the Black Lotus Labs report. Defanged for safety — re-fang before loading into tooling.
| Indicator | Resolves / notes |
|---|---|
| c2iznja[.]com | Current C2 domain |
| api80.c2iznja[.]com | 202.144.192[.]149 — AV-enum exfil |
| live-hk.c2iznja[.]com | 202.144.192[.]149 — hardcoded |
| newdma.c2iznja[.]com | 202.144.192[.]13 |
| turbo.c2iznja[.]com | 210.1.231[.]13 |
| base64.c2iznja[.]com | 202.144.192[.]149 |
| chat5188[.]tk | Historical C2 domain |
| api08.chat5188[.]tk | 210.1.226[.]236 — hardcoded fallback |
| beacon.chat5188[.]tk | Embedded C2 |
| Type | Value |
|---|---|
| Malicious DLL | OnKeyToken_KEB.dll |
| Config file | OnKeySrv.dat |
| v1 loader | Update.log |
| Sideload host | OnKeySrv.exe (legit Tendyron) |
| Mutex/GUID (v1) | {5861573B-FF85-4C7A-BBAD-EFC01540357D} |
| Mutex/GUID (Linux v2.1) | {534E19D5-434B-4cad-A0C2-8D75E0B2FBFC} |
| User-agent | HTTP Downloader |
| Config markers | &#…#& (IPs) · $@…@$ (domains) |
| IP-lookup service | icanhazip[.]com (abused for host IP) |
| SHA-256 |
|---|
| dffa94a0f9c4dc38d475a32741f7f134cc934c7b98bec581c135da1b5aa1983f |
| 329f06012bca465dcaf1edbfdc20f1209b8ea00f269a8b890f165fb8c82c32d6 |
| c4d4f8ccc9d2c4d289d8672396fdf0818b81551376057d43e76de66e29d73604 |
| ce4ce009fcebacf0b7e253409f1b192081b77f4d56bb3af0fa71d125aa060c51 |
| 5d06c1b06b48e9f61fec86179f194e0f611d6cf7495e0370a58844f0dddb437d |
09 · Detection & Hunt Queries
Phase 9 / 12Every query below is paired KQL (Microsoft Sentinel / Defender) and SPL (Splunk), each preceded by what it finds. Tune time ranges and table names to your environment.
10 · MITRE ATT&CK Mapping
Phase 10 / 12Techniques observed or strongly implied by the Black Lotus Labs analysis. Dead-code capabilities are noted as such rather than mapped as confirmed behaviour.
| Tactic | Technique | ID |
|---|---|---|
| Execution | PowerShell (v1 stager) | T1059.001 |
| Defense Evasion | DLL Side-Loading | T1574.002 |
| Defense Evasion | Process Injection (remote thread) | T1055 |
| Defense Evasion | Masquerading (Kingsoft identity) | T1036.005 |
| Defense Evasion | Obfuscated Files (fake timestamps) | T1027 |
| Defense Evasion | Deobfuscate/Decode (XOR config) | T1140 |
| Discovery | System Information Discovery (WMI) | T1082 |
| Discovery | Security Software Discovery | T1518.001 |
| Command & Control | Application Layer Protocol (MQTT) | T1071 |
| Command & Control | Non-Standard Port | T1571 |
| Command & Control | Multi-Stage Channels | T1104 |
| Command & Control | Fallback Channels | T1008 |
| Command & Control | Ingress Tool Transfer (plugins) | T1105 |
| Command & Control | Proxy (Cloudflare / SoftEther) | T1090 |
| Exfiltration | Exfiltration Over C2 Channel | T1041 |
| Collection (dead code) | Input / Clipboard / Screen / Audio Capture | T1056 / T1115 / T1113 / T1123 |
11 · DFIR & Hardening
Phase 11 / 12A responder's order of operations if a host lights up on the queries above, followed by proactive hardening.
- 1On any host loading
OnKeyToken_KEB.dll, capture the DLL,OnKeySrv.datand process memory before isolating — the config decrypts to live C2. - 2Block the domains and IPs from Phase 7–8 at the egress proxy and firewall, then hunt retrospectively for the odd-port MQTT sessions network-wide.
- 3Because plugins are pushed at runtime, assume keylog/clipboard/screen capture may have been enabled. Rotate credentials entered on the host during the exposure window.
- 4For the router tier: audit MikroTik/DrayTek devices for unexpected SNMP exposure (UDP/161) and unauthorized config or VPN termination.
- 1Enforce WDAC/AppLocker rules that validate module signatures, not just the parent EXE, so a signed host cannot load an unsigned companion DLL.
- 2Deny MQTT egress from user and server segments by default; permit it only from designated IoT/OT VLANs to known brokers.
- 3Alert on any outbound TCP to 2883/63196/63916/64332 and on long-lived sessions with 60 s keep-alive patterns.
- 4Inventory whether Tendyron OnKey token software is present anywhere in the estate; if unused, remove it to eliminate the sideload host entirely.
- 5Close SNMP (UDP/161) on internet-facing routers and replace default community strings.
- No host loads OnKeyToken_KEB.dll and no OnKeySrv.dat / Update.log remain
- Egress to all Phase 7–8 indicators is blocked and shows zero hits
- Odd-port MQTT hunt returns zero results across the estate
- Credentials used on affected hosts have been rotated
12 · Sources & References
Phase 12 / 12◈ Check your estate for BambooToken exposure
Run the domains, IPs and hashes from this brief through the CyberHawk IOC Scanner, and browse more active-threat breakdowns on the Threat Intel feed. For paired KQL/SPL detection content, see the CyberHawk blog.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."