BambooToken: DLL Side-Loading in Legitimate Software and MQTT C2

1. Basic Information

• Original Title: The banana stand: brokering and managing infections across Asia using MQTT
• Sources: Lumen Black Lotus Labs, BleepingComputer
• Published Date: 2026-09-15
• Updated Date: None
• Severity: High
• Basis for Severity: Lumen assesses based on technical artifacts that the activity has been active since at least 2023. Supporting Windows and Linux, the campaign showed communications indicating compromises of corporate backends and GitLab, along with remote control using MQTT. Downstream software tampering is unconfirmed.
• Original Link: The banana stand: brokering and managing infections across Asia using MQTT
• Related Source: BleepingComputer: BambooToken malware controls Windows and Linux systems via MQTT
• Related Entities: BambooToken, Tendyron OnKey, Kingsoft Office, MQTT, Eclipse Mosquitto, GitLab

2. Executive Summary

BambooToken uses DLL side-loading into a legitimate signed OnKey executable on Windows and runs as an ELF executable on Linux. It relays commands via MQTT, and Lumen observed traffic indicating compromises of corporate backends and GitLab.

3. Attack Flow

Flow 1: Windows Version: DLL Side-Loading and MQTT Communication Confirmed via Sample Analysis

1. A legitimate signed OnKeySrv.exe loads the malicious OnKeyToken_KEB.dll. The method used to place the file on the target is unknown.
2. The malware uses WMI to enumerate the OS, product information, and license details.
3. It subscribes to an MQTT topic containing a GUID and sends online and offline status updates. The GUID embedded in the sample is not necessarily a unique value per device.
4. It receives plugin-related commands distributed by the broker. MQTT works by having publishers send messages to topics, which the broker then relays to subscribed receivers.

Flow 2: Linux Version 2.1: Behavior Confirmed via Sample Analysis

1. The ELF executable starts and daemonizes if the argument i is provided. It decrypts the embedded C2 and GUID using XOR.
2. It subscribes to a total of five MQTT topics related to general status and specific GUIDs, sends status updates, and waits for commands.
3. The SHELL, FILEEX, and ONLINE routines handle shell launching, file operations, and host information reporting. The initial access method and how the ELF was launched have not been published.

4. Attacker Position and Execution Location

• Attackers use C2 infrastructure such as MQTT brokers to send commands to infected devices.
• The malware operates as a DLL loaded by a legitimate process on Windows, and as an ELF executable on Linux.
• The MQTT connection destination is a broker, meaning direct connections between the command source and the endpoint are not required behind the broker. This does not eliminate communication to the infrastructure used by the attacker.

5. Visibility for Victims and Administrators

Victims

• Inference: The malware may run without visible warnings and, on Windows, may appear to be normal activity by the legitimate OnKey process.

Administrators

• Inference: If module loading is logged, the path and hash of the DLL loaded by OnKeySrv.exe can be checked. A legitimate executable signature alone cannot determine the safety of a DLL.
• Inference: Connection logs may show MQTT connections to external brokers. With TLS-encrypted communication, topics and contents cannot be verified using standard network logs alone.

6. Conditions for Success and Failure

Success Conditions

• For the Windows version, the placement and execution conditions must be met so that the malicious DLL is loaded by the legitimate executable.
• For the Linux version, the ELF executable must be successfully launched. Windows DLL side-loading is not a prerequisite for the Linux version.
• For variants using MQTT, outbound connections to the broker and topic subscriptions must succeed so that commands can be delivered. This is distinct from initial HTTP communication types.

Failure Conditions

• Inference: Application control including DLLs on Windows, and execution control for binaries and services on Linux, may prevent the malware from starting.
• Inference: Restricting unnecessary MQTT destinations may block remote control. Public IOCs include ports 2883 and TLS 8883 in addition to TCP/1883, so blocking only port 1883 is not exhaustive.
• Inference: Suspicious DLL loading, WMI enumeration, and Linux processes with outbound communication must be correlated and isolated after detection. Detection alone does not mean execution was blocked.

7. Impact upon Success

• Analyzed capabilities include a remote shell, file operations, and host information reporting.
• Related Windows plugins collect antivirus product information and send it via HTTP. Not all related communications use MQTT.
• Compromises of corporate backends and GitLab can impact sensitive data or downstream deliverables, but specific data theft or downstream tampering remains unconfirmed.

8. Observable Logs

Email

• Inference: The initial delivery vector is unknown. Do not assume email delivery; verify only if records precede the infection timestamp.

Proxy / SWG / DNS

• Inference: Inspect name resolution and traffic destinations under c2iznja[.]com and chat5188[.]tk. Include HTTP traffic from related plugins.

Endpoint / EDR

• Inference: Check the relationship between OnKeySrv.exe and OnKeyToken_KEB.dll, WMI activity, mutexes, and Linux ELF binaries, daemons, and child shells. Requires configured collection of module and process auditing.

Identity / IdP

• Inference: Review GitLab authentication and token usage after the compromise timestamp. Since the initial access vector is unknown, IdP usage cannot be conclusively determined.

SaaS / Cloud

• Inference: Check GitLab audit logs, repository history, and CI/CD records for changes to tokens, runners, code, and build artifacts.

Network

• Inference: Check connection destinations, ports, duration, and transfer volume for MQTT brokers. Topics and contents should be examined if decryption or broker-side logs are available. The 15-second delay in Linux samples is for handling missing responses and is not treated as constant periodic communication.

9. Attack Success Determination

Confirmed via Public Information

• Malware Execution or Successful Authentication Confirmed: Public Information: Lumen analyzed traffic with C2 and assessed that it indicates compromises of corporate backends, GitLab, and other services. A distinction must be made between capabilities identified in samples and confirmed command execution on individual endpoints.

Internal Criteria for Organization

• Initial Execution Confirmed: Criteria: Confirm malicious DLL loading on Windows or ELF execution on Linux using execution logs from the target endpoint. Code analysis of samples alone does not confirm initial execution in the victim environment.
• Data Theft or Session Compromise Confirmed: Criteria: Corroborate file transfer contents/destinations or unauthorized token usage. MQTT connections or GitLab change records alone do not confirm data theft. Public information does not show specific stolen content.
• Subsequent Compromise Confirmed: Criteria: Confirm evidence that GitLab or backend compromises led to tampering with downstream code/artifacts or malicious distribution. This remains unconfirmed in public information.

10. Investigation Playbook

Trigger

• Inference: Triggered by suspicious OnKey DLL loading, external MQTT traffic with unknown purpose, or known C2 indicators.

Initial Triage

• Inference: Verify target hosts, OS, software, file signatures and hashes, and the timestamp of the first communication.

Endpoint and Server

• Inference: Preserve records of process lineage, loaded modules, WMI activity, services/daemons, and file operations.

Authentication and Cloud

• Inference: Review usage history for GitLab tokens, runners, repositories, and related cloud credentials.

Follow-up Actions

• Inference: Sequentially investigate shell commands, additional plugins, file transfers, repository changes, and downstream builds.

Containment

• Inference: Isolate hosts and C2 traffic to preserve samples and logs. Depending on the scope of compromise, revoke and reissue credentials for GitLab and related services, and update dependent processes.

Decision Categories

• Inference: Evaluate file placement, malware execution, MQTT connection, command execution, data theft, and downstream impact separately.

11. Defense and Detection Ideas

Single Event

• Inference: Check for unapproved DLL loading by OnKeySrv.exe or external connections from server processes that do not normally use MQTT.

Time-Series Correlation

• Inference: Correlate legitimate processes, malicious DLLs, WMI, and MQTT traffic on Windows; and ELF execution, communication, child shells, and file operations on Linux.

Threat Hunting

• Inference: Hunt for OnKey execution history, Linux hosts, known C2, and outbound traffic from GitLab and backends. Do not limit searches to known ports only.

Log Deficiencies

• Inference: Encrypted traffic, missing module load logs, or insufficient Linux execution records may prevent confirmation of commands or execution stages.

Priority Mitigations

• Inference: Prioritize OS-specific execution controls, outbound traffic restrictions on servers, and GitLab auditing and artifact verification. Do not rely solely on signatures or TCP/1883.

12. Facts, Inference, and Hypothesis

Facts

• Lumen assesses based on technical artifacts such as samples that the activity ran from at least February 2023 through July 2026.
• The Windows version side-loads OnKeyToken_KEB.dll into the legitimate signed OnKeySrv.exe. Another variant mimicking Kingsoft Office fails signature verification and cannot be equated with legitimate Kingsoft signed code.
• Variants from 2024 to 2025 subscribe to MQTT topics and exchange commands and status via a broker. The GUID in the topics contains a value embedded in the sample and must be distinguished from device-specific identifiers.
• Linux version 2.1 is an ELF executable implementing shell execution, file upload/download/deletion, and host information collection.
• Lumen analyzed IPs communicating with C2 and reported identifying approximately 12 compromised organizations and services. Targets include mobile app backends, legal and financial entities, hotels, software development, and GitLab.
• Strings suggesting keystroke logging, clipboard theft, and audio/camera/screen capture are derived from code not in the normal execution path. Execution of these corresponding capabilities has not been confirmed.

Inferences

• Permitting MQTT indiscriminately as legitimate IoT traffic may cause teams to overlook traffic to brokers relaying commands. Brokers should also be a target for investigation and traffic control.
• Compromised GitLab and mobile app backends can serve as footholds for supply chain attacks, though downstream code tampering or distribution has not been confirmed.

Hypotheses

No additional hypotheses. Unconfirmed items are listed under "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

• T1574.001 Hijack Execution Flow: DLL (Confidence: High): Side-loads malicious DLLs into legitimate OnKey executables on Windows.
• T1071 Application Layer Protocol (Confidence: High): Uses MQTT publish and subscribe for C2.
• T1082 System Information Discovery (Confidence: High): Includes routines to gather OS, BIOS, CPU, and memory information.
• T1059.004 Unix Shell (Confidence: High): SHELL routine in the Linux version launches a command shell.
• T1105 Ingress Tool Transfer (Confidence: High): Includes capabilities for loading plugins and transferring files to endpoints. Mapping is based on capability analysis.

14. Unknowns and Further Investigation

• Methods used to place Windows files or Linux ELF binaries on targets and execute them.
• Initial access timestamps, stolen data, and executed commands for each target.
• Implementation and distribution status of monitoring features indicated by strings outside the normal execution path.
• Attribution to a specific threat actor group.

15. Impact on SOCs and Organizations

Even legitimate signed software can be used in compromises if a pathway exists to load an alternative malicious DLL. Environments using OnKey must verify loaded DLLs, and Linux backends require separate reviews of ELF and service startup logs. Connections to MQTT brokers should also be monitored, and if compromises such as GitLab are discovered, additional evidence must be used to determine whether downstream deliverables were impacted.

16. Summary by Role

• SOC: Correlate OS-specific execution logs with MQTT and HTTP traffic, evaluating broker connections, command execution, and data theft separately.
• Administrators: Inventory target software and Linux servers, and restrict unnecessary outbound traffic. For targeted GitLab environments, verify tokens, runners, code, and artifacts.
• Users: Report unfamiliar software execution or warnings. The absence of on-screen anomalies alone does not guarantee safety.