Cybersecurity experts have revealed the specifics of a multi-platform campaign that employs the MQTT protocol for communication, targeting Windows and Linux systems. The BambooToken malware family, identified as emerging in February 2023, has been observed active and utilized in cyberattacks against organizations in Asia and South America. While neither Tendyron's code-signing certificate nor its build environment has been compromised in connection with the activity, it's suspected that the operators are relying on potentially vulnerable binary code that can be sideloaded into targeted networks.
Notably, the Chinese nation-state hacking group known as Mustang Panda was observed employing a backdoor called MQsTTang, which leveraged the IoT messaging protocol to execute commands on compromised hosts.
Subsequent versions of the malware replace a rogue version of the DLL ("OnKeyToken_KEB.dll") used by the Tendyron OnKeySrv program to enumerate the host and enter into a command loop that uses MQTT for C2. BambooToken is designed to collect comprehensive host information and delivers an antivirus plugin for Windows, which uses the Windows Management Instrumentation (WMI) framework to gather details about installed antivirus products on the machine and exfiltrate them to the C2 server at "api80.c2iznja[.]com". Mobile apps and smartwatches linked to cellular networks could enable pattern-of-life analysis; targeting financial institutions could expose transaction data, and attacking hospitality systems could reveal travel history and plans."
