BambooToken Linux Backdoor Uses MQTT for Remote Shell and File Exfiltration

Key Takeaways

• A new Linux backdoor, dubbed BambooToken, has been discovered using the MQTT protocol for command and control (C2) operations.
• BambooToken enables attackers to gather system information, execute arbitrary shell commands, and exfiltrate files from compromised Linux machines.
• The malware leverages encoded MQTT topics and payloads, complicating immediate detection and analysis.
• While the initial infection vector remains unknown, its presence on a system grants significant remote access capabilities.

A recently uncovered Linux backdoor, dubbed BambooToken, has been observed leveraging the lightweight Message Queuing Telemetry Transport (MQTT) protocol to establish a robust remote control channel. This sophisticated implant is capable of extensive host reconnaissance, executing shell commands, and facilitating file transfers between compromised Linux systems and its operators.

The use of MQTT is particularly noteworthy, given its widespread adoption in Internet of Things (IoT) and connected-device environments. MQTT’s publish-subscribe model, which relies on a central broker to relay messages, offers an effective method for threat actors to obfuscate their direct connection to infected endpoints.

Security researchers at Reverser identified the BambooToken implant through meticulous analysis, which involved decoding a small, embedded configuration block and tracing its MQTT callbacks. Reverser said in a report that the malware comprises distinct modules for host inventory collection, command execution, and file management, all orchestrated through encrypted MQTT topics.

While the initial access method, delivery mechanism, the specific threat group behind it, or any active victim campaigns have yet to be determined, successful deployment of BambooToken on a Linux system grants an attacker substantial control over system details, command output, and locally stored data.

BambooToken Linux Backdoor Uses MQTT C2

Upon execution, BambooToken initializes by decoding a 59-byte configuration blob, which reveals the MQTT broker’s address and a predefined group topic. It then generates a unique, UUID-like client identifier for its running process.

The backdoor attempts to connect to its configured MQTT broker via TCP port 2883. In the event of a connection failure, it implements a 15-second retry delay. Crucially, BambooToken also registers an “offline” status message with the broker, a feature that could aid attackers in tracking the availability of compromised systems.

The control client component of BambooToken actively monitors for messages on the designated group topic, its unique client identifier, and several other specific topic names. Separate internal modules are dedicated to processing shell command requests and managing file operations. This publish-and-subscribe architecture mirrors established techniques for abusing MQTT messaging protocols, where the broker effectively serves as an intermediary, insulating the attacker from direct interaction with the compromised endpoint.

BambooToken employs a repeating XOR operation to obscure both its payloads and MQTT topic labels. While this encoding method can hinder casual inspection, it provides limited protection once the XOR key is known. Security analysts should consider any unusual MQTT sessions originating from Linux servers as a strong indicator for further investigation, rather than conclusive proof of compromise, especially when evaluating network context.

Shell Command Execution

The shell execution module processes JSON-formatted requests containing an “operation” field set to “command”. The text provided within this field is then passed to the system shell using /bin/sh -c. The output generated by these commands is read in 1,024-byte increments and subsequently relayed back to the C2 controller. It’s important to note that each command request triggers a new process, rather than establishing a persistent interactive shell session.

This capability provides attackers with a flexible mechanism for system enumeration, data collection, and preparing follow-on actions. For defenders, this highlights the necessity of examining network context when investigating suspicious command execution, a pattern frequently observed in other MQTT-controlled malware.

File Control and Detection

The file management component of BambooToken is highly functional, allowing attackers to list directory contents, download files from the victim, upload new content to the system, and delete regular files. Downloaded data is transmitted in 128-KiB chunks, with a JSON header preceding the raw file bytes, separated by a NUL character. This specific data format could potentially bypass parsers that strictly expect a pure JSON message, leading to missed detection of the transferred content.

Interestingly, directory listings generated by BambooToken include a misspelled field, “flies,” alongside standard file attributes such as names, types, sizes, and timestamps. This unique protocol anomaly could serve as a valuable identifier for analysts decoding BambooToken traffic. Furthermore, the malware exhibits characteristics suggesting a potential Windows-centric origin for its management interface, as it adjusts Windows-style paths and utilizes Windows-style time values.

When BambooToken receives an “ONLINE” request, it gathers a comprehensive inventory of system information. This includes the username, hostname, operating system release, machine identifier, network configuration details, processor model, and running process information. The malware first attempts to retrieve the machine identifier from /etc/machine-id, with a fallback option to a path under /var/lib/myapp. This fallback path could provide a crucial correlation point during incident response investigations.

What You Should Do

• Monitor Network Traffic: Actively scan for unfamiliar Linux ELF files initiating connections to the identified MQTT broker or historical IP address on TCP port 2883.
• Correlate Events: Cross-reference suspicious network activity with the creation of child /bin/sh -c processes and unexpected file access patterns.
• Analyze MQTT Sessions: Look for encoded MQTT topics, the unusual “flies” field in directory listings, and data streams split by a NUL byte, which are strong indicators of BambooToken activity.
• Restrict Outbound MQTT: Implement strict firewall rules to limit unnecessary outbound MQTT traffic from your network segments.
• Log Broker Connections: Ensure comprehensive logging of all MQTT broker connections and activity within your environment.
• Preserve Evidence: In the event of a suspected compromise, capture relevant network traffic and isolate the affected host immediately to collect volatile evidence.
• Validate C2 Infrastructure: Be aware that reported C2 addresses may be historical. Always validate current resolution and connectivity of suspected infrastructure rather than assuming it remains active or inactive.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.