The banana stand: brokering and managing infections across Asia using MQTT

Black Lotus Labs®, the threat research division at Lumen, uncovered BambooToken, an emerging malware family using the Message Queueing and Telemetry Transport (MQTT) to quietly control infected Windows and Linux systems. Active since at least 2023, the campaign points to a skilled threat actor using stealthy infrastructure, side-loading techniques and broad access to collect data from targeted environments across Asia and South America. The findings show how early detection, supply chain visibility and proactive threat mitigation can help expose discreet techniques before adversaries expand them against higher-value targets.

Key findings

• Researchers at Black Lotus Labs identified a multiplatform campaign using the MQTT system for communications targeting Windows and Linux systems. Based on technical artifacts, we believe this campaign was active since at least February 2023 and continued through July 2026.
• Lumen observed network telemetry indicating infections on at least four different backend servers for mobile applications, legal and financial services, a software company related to smartwatches, a hotel and one GitLab instance.
• The Windows agent was sideloaded by the Tendyron “OnKey” program, which validates system access by retrieving cryptographic material stored on a USB drive. This product line is popular in Chinese banking and government networks.
• The domains used Cloudflare as a proxy for their infrastructure. One domain associated with the 2025 campaign recently entered the top 500,000 domains on Cloudflare Radar. The older domain ranked in the top 1 million at the peak of operations in 2024, indicating widespread infection across campaigns for this activity cluster.

Read the full research to understand BambooToken’s reach, security implications and why teams should act quickly to protect their networks from this dangerous threat actor.

Understanding BambooToken’s reach and implications

As part of our proactive hunt efforts, Black Lotus Labs discovered an undocumented malware family uploaded to VirusTotal in early 2026. Our investigation began when we identified the malware family's most recent version, dubbed “BambooToken.” Based on artifacts in the embedded samples, we assess that the actors have a full range of surveillance capabilities. They can also operate under the radar, as evidenced by the accompanying Windows framework dating back to February 2023. We are unable to correlate this malware framework to any publicly documented activity clusters and are labeling it as an emerging threat cluster.

The actor used Tendyron’s “OnKey” software to sideload agents into targeted machines. Tendyron creates hardware-based tokens employed in high-security settings to verify user identities for workstation access. Their website lists customers in China’s financial and government sectors, among other verticals.

Lumen assesses that neither Tendyron’s code-signing certificate nor its build environment was compromised. We suspect the actors are abusing a file vulnerable to sideloading and likely to be found natively within the targeted networks. Most BambooToken samples were uploaded from Chinese IP space, along with corresponding telemetry from servers geolocated within China, indicating a data collection campaign against a user base within China and neighboring countries.

While the current activity appears to focus on Southeast Asia and South America, we have seen People's Republic of China (PRC)-based activity clusters test new capabilities in discreet locations before leveraging these techniques against global targets, especially sophisticated actors like Volt Typhoon, GhostEmperor and the actor behind ZuoRAT. More recently, we observed a shift in targeting Latin America from PRC-aligned actors. With success in more discreet locations and targets, we expect the tactics, techniques and procedures (TTPs) seen here to be used in the future against more valuable or strategic targets.

It would be remiss not to acknowledge the campaign's potential supply chain implications, as it compromised a GitLab server, a software development company and several backend servers used by mobile applications. One C2 domain reached Cloudflare Radar’s top 500,000 domains while another is in the top 1 million, indicating that the actor has experience running wide-reaching campaigns.

Inside BambooToken’s MQTT-based malware framework

The unusual protocol behind BambooToken’s C2 activity

The BambooToken sample broke the norm for malware communications by implementing MQTT for remote command and control. MQTT is typically used for communications between IoT devices and controllers. This system uses a “publish-and-subscribe” architecture, whereby incoming messages are published to “topics” and received by “subscribers,” with message distribution managed by a central hub known as a “broker.”

From an attacker’s perspective, one benefit of MQTT is that it hides the rest of their infrastructure behind a broker. As a result, the compromised machine never communicates directly with the C2 server. This protocol also allows for asynchronous communication. Lastly, even if a bot is infected and attempts to “subscribe” to a topic, the broker must approve it before it receives messages.

While this implementation of MQTT is not completely novel, it is rare. Our research into prior campaigns identified only three that used MQTT. The first involved IOT malware IOCONTROL, the second was associated with Korplug (aka "PlugX") and the third was a cybercrime malware family called WailingCrab. While the Korplug malware was also associated with a suspected PRC-aligned threat actor, we did not identify additional overlap with the BambooToken malware based upon technical indicators.

Introducing the BambooToken malware family

Version 1: February 2023

Initial VirusTotal submissions indicate the BambooToken framework first appeared in February 2023. We believe the infected process began with a file named Update.log, which called a remote thread and then injected the file into memory.

The agent was written in C++ and begins by XOR-decoding a hardcoded string that denotes the GUID of the infected system—in this case, {5861573B-FF85-4C7A-BBAD-EFC01540357D}. The string functions as a mutex: if it already exists on the host, the program exits to prevent multiple agents from running at the same time.

Next, the agent checks for an OnKeySrv.dat file, the same filename as the side-loaded executable OnKeySrv.exe. If the .dat file exists, it reads the file and decrypts the contents, which contain a malleable profile. From here, the agent searches for the markers “&#” then “#&” to extract an IP address for a C2 node. It then looks for “$@” and “@$” markers, used as a field included in the host-profile beacon[.]chat5188[.]tk.

If the .dat file is not found, the agent decodes and then falls back to the embedded hardcoded C2: api08[.]chat5188[.]tk. The agent then enters the C2 loop when either OnKeyT_AppendEventInfor or OnKeyT_ContextInit is called. However, it does not appear to interact with OnKeysrv.exe otherwise.

After extracting the C2, the binary will gather information about the computer, including:

• Architecture
• CPU info
• Memory
• Public IP address, parsed from icanihazip[.]com
• MAC address
• File information
• The string V9.
• The bytes decrypted from the .dat file (empty if not a .dat file)

The malware transmits this data to the C2 server. The C2 response includes a header containing three fields: a command identifier, a size value and a payload. Identified commands include:

• No-op
• Load a new plugin
• Stop all plugins
• Terminate the malware
• Disconnect from the C2

Other possible commands appear, but they do not seem to be implemented in this version. The dead code section of this article explores additional commands and plugins.

Version 2.0: Progression to MQTT Communications

The malware variant continued to develop from 2024 to 2025. This new version implements MQTT for C2 communications in lieu of the standard HTTP used in 2023. The Windows campaigns employ the technique “hijack flow execution,” where actors exploit a vulnerability in a legitimate program’s execution flow to sideload an actor-created file. In this case, the actor would sideload into the legitimate program OnKeySrv. to run their malicious file, OnKeyToken_KEB.dll. The OnKey program was registered with NIST as: “OnKey193 USB Token provides RSA, TDES, AES, RNG cryptographic service for government and corporate identification, payment, banking and web applications.” According to Crunchbase, Tendyron Corporation innovations in the USB token space “led to their widespread application in Chinese banks.” The hijacked program, OnKey, had a valid Microsoft certificate issued to Tendyron Corporation. Lumen does not assess that Tendyron's code signing certificate was compromised. Preliminary analysis indicates the signed executable appears benign and was vulnerable to side-loading rather than actively abused through a certificate compromise.

One variant masqueraded as a legitimate program, "Zhuhai Kingsoft Office Software Co., Ltd.," employing a technique previously outlined by SpecterOps. Zhuhai Kingsoft Office Software is an office productivity application native to China, similar to Microsoft products such as Word, Excel and PowerPoint. Lumen does not assess that the threat actors obtained access to Zhuhai's code-signing certificate. The variant's files fail certificate signature validation, indicating the certificate was not used to sign the malicious components.

Once the malicious file executed, it began enumerating the host machine through Windows Management Instrumentation (WMI), collecting operating system information, computer system product details, the original product key, serial number and software licensing service information.

Then the binary enters a loop, subscribing to 4 topics: a global broadcast and three specified topics that were appended to the GUID. Next, it creates an MQTT message and publishes it to the C2 on a global broadcast topic. We assess that the BambooToken malware employs an open-source library called Mosquitto, developed by Eclipse. The payload includes a gid, which denotes the GUID embedded in the accompanying malware sample and includes a message indicating whether the bot was online or offline. For example:

{
"op": "offline",
"gid": "{COMPUTED-HOST-GUID}"
}

The agent would then attempt to subscribe to the four MQTT topics. The concepts behind MQTT and topics are described below. The first topic was once again “Global,” and the three additional embedded topics were:

- {GUID}/unPlugin [sic]

- {GUID}/removePlugin

- {GUID}/Plugin

- {GUID}/

BambooToken version 2.1: Extensive host-based enumeration and Linux

The most recent sample we correlated to this campaign was compiled for Linux and first observed in December 2025. This sample had the most robust host-based enumeration and used a different MQTT topic structure. Based on technical overlap, we assess with high confidence that the Windows and Linux toolsets belong to the same activity cluster.

The Linux sample still appeared to be under development, as it had three initialization arguments: “i,” “p” and “v.” Only “i” had a defined function that daemonized the process. After parsing the command-line arguments, it XOR-decodes the hardcoded C2, live-hk.c2iznja[.]com and the embedded GUID {534E19D5-434B-4cad-A0C2-8D75E0B2FBFC}. It also creates the URLs that it will subscribe to in the main loop:

The binary enters a loop subscribing to five topics: a global broadcast topic and four additional topics appended to the GUID. The binary then publishes an MQTT message to the C2 on the global broadcast topic. The payload contains a gid derived from the host machine, along with a status message indicating whether the bot is online or offline, consistent with the prior version's behavior. The four specific MQTT topics embedded within the agent are:

- {GUID}/Plugin

- {GUID}/removePlugin

- {GUID}/LUA

- {GUID}/

The message is sent with a 60-second timeout and enters a loop waiting for a response. If it receives no response, it sleeps for 15 seconds and then repeats the main loop.

Handlers for the subscribed URLs and embedded predefined functionality

Analysis reveals three command handlers. The SHELL handler creates a thread that spawns a command shell. The FILEEX handler creates a thread enabling operators to download, upload and delete files, stop execution and exit. The ONLINE handler collects host-based parameters and transmits them to the C2 server as a heartbeat beacon. The following parameters are collected by the ONLINE handler:

• online
• GUID (unique tag embedded within the agent, likely to denote the campaign)
• Name (predefined as Linux, potentially denoting hostname on Windows)
• System
• BIOS
• Product (predefined as Linux on ELF samples)
• Serial number (predefined as Linux on ELF samples)
• Computer
• MAC address
• Macname (predefined as Linux on ELF samples)
• LAN
• path
• CPU
• Memory
• Process ID (pid)
• Thread ID (tid)
• Version
• Architecture (predefined as Linux on ELF samples)

The agent periodically checks in with C2, awaiting further instructions.

BambooToken: antivirus plugin

While newer MQTT-based variants of the malware contain references to plugin topics, only one likely plugin has been identified to date. This plugin creates a loop with a timer that triggers every five seconds, using Windows Management Instrumentation (WMI) to collect information about antivirus products running on the local machine. The plugin then transmits this data to the C2 server, whose address is XOR-encoded and embedded within the binary.

The antivirus information is sanitized, then sent in a GET request such as: http://api80.c2iznja[.]com/Windows_Defender/Malwarebytes/ with the user agent “HTTP Downloader.” We suspect this plugin was likely the first deployed, intended to prevent researchers from retrieving their other tools. Our analysis also uncovered some artifacts that indicate the existence and functionality of subsequent plugins.

Development environment, dead code and artifacts

Technical overlap and environmental artifacts

After analyzing Windows samples associated with BambooToken, we noticed many samples used the same XOR key. We then observed similar RichPE Header information across the samples associated with both the 2025 and the 2024 campaigns. This suggests both sets of samples may have been compiled from a common codebase and environment.

This caught our eye, as many of these files were first submitted to antivirus scanners such as VirusTotal in 2024. However, the samples themselves contain PE header information indicating they were compiled on Windows Server 2003 with Visual Studio 2005. This led us to believe these markings were either inauthentic or that development occurred in an isolated environment. Either action was almost certainly part of the threat actor's sanitization process, showing meticulous attention to detail.

Even more striking, the actor did not forge all variables—such as the compilation timestamp—to be the same, as that itself could become a signature. Instead, they introduced some variance while keeping values within acceptable ranges.

What is dead code?

The analysis above focused on the code that executed when the program ran. The unexecuted sections, commonly referred to as “dead code,” were equally notable. Dead code consists of snippets that remain in a compiled binary even though they do not run during normal program operation. These artifacts typically do not affect functionality, but they can reveal development history, planned capabilities or linked library remnants that are visible only through static analysis.

Developers typically remove these dead code sections by setting compilation flags such as /OPT:REF (“References") and /Gy ("Enable Function-Level Linking") to remove unnecessary code. During our investigation, we uncovered a BambooToken sample where the developer failed to set the flags during compilation.

Analysis revealed strings of interest corresponding to additional plugins. Although no corresponding functions were identified in the execution flow, their naming conventions suggest likely functionality. Strings prefixed with COM_ likely reference Component Object Model (COM) techniques commonly observed in malware. Of particular note are KEY_RECOURD[sic], suggesting a keylogger, and COM_clipboard, suggesting clipboard access—both of which would enable an operator to retrieve credentials from an infected host. Additional strings indicate the ability to record audio and capture images from the webcam and desktop display.

What led to these errors?

Once we identified these strings, our next challenge was determining how they were added to the malicious file. Without access to the developer’s environment or source code, we could not confirm the cause, so we looked for a reasonable explanation. We located the relevant strings by their relative virtual address (rva in the read-only data (.rdata) section of the PE file. As described in Matt Pietrek’s classic article, Peering Inside the PE, the .rdata section is used for at least two things: first, in Microsoft linker-produced EXEs, and secondly, the .rdata section holds the debug directory, which is only present in EXE files.

Of the three debug formats, Common Object File Format (COFF) is the most common. Its symbolic debugging information includes string names for program functions and variables, plus line number data used for setting breakpoints and tracing execution.

The first plausible explanation was that these strings might have been present as comments in the codebase, included in debug records. Typically, dead code is the result of something as benign as comments or references to branches that are removed during refactoring. This suggests that these functions could belong to an earlier version of the project, with the developer transitioning to a more modular framework where such utilities are deployed as plugins.

The second plausible explanation is slightly more complex. Visual C++ applies the relevant compilation flags by default in Release mode for new projects. However, when statically linking against a library, that library must also have been compiled with /Gy for the flags to take effect across the entire binary.

Since this library was still in development, it contained some function names but not the corresponding code, which is another feature of the PE format: Visual Studio merges the IAT (import address table) and Import Directory (and some other directories) with the read-only data into the .rdata section. This supports the theory that the developer statically linked to a C++ library and explains why the /Gy flag was not set properly. Additionally, because the developer was also using an older version of Visual Studio (the 2005 version based on embedded metadata), it then copied over some of those function names as import functions from the library into the .rdata section of the PE file.

Enumeration of the network and Lumen telemetry

Infrastructure correlations between the 2024 and 2025 campaigns

Lumen subsequently identified two IP addresses that exhibited overlap between the original C2, chat5188[.]tk, domain and a second domain, c2iznja[.]com. We assess that chat5188[.]tk denotes a historical C2 node used in a campaign by the same activity cluster during late 2024. We suspect these servers may have been used to transition previously infected devices from the old domain to the newer payload, which uses the domain c2iznja[.]com, to maintain access to those systems.

The first IP address that exhibited this correlation was 210.1.231[.]13. This IP address was first observed resolving the hostname turbo[.]c2iznja[.]com. At the same time, it had an X.509 certificate on port 443 associated with the domain api06[.]chat5188[.]tk. Censys still observed it in the wild as of April 21, 2026, and it had a SHA256 fingerprint of 44e3580d84ba7534e815ae9c12c4165fbc9313adc7475808908fec26e9b17f19. It was no longer valid because it had passed the allocated expiration date.

The second IP address exhibiting this correlation between the two campaigns was 202.144.192[.]149. It was first observed resolving two hostnames according to VirusTotal: api80.c2iznja[.]com since January 20, 2026 and ccc80.c2iznja[.]com since May 9, 2026. Simultaneously, Censys reports that this IP had two X. 509 certificates associated with the older domain: api06.chat5188[.]tk on port 443 and apis.chat5188[.]tk on port 2083.

During our analysis of these domains, we noted the popularity score, as the domain c2iznja[.]com appeared in the top 500,000 domains based upon the Cloudflare Radar ranking system on December 28, 2025. We then checked the popularity ranking for the historical C2 domain chat5188[.]tk, which appeared in the Cloudflare Radar top million domains on December 17, 2024.

Clustering of targets from Lumen telemetry

We ran the list of dedicated indicators through our data lake, then bifurcated the IP addresses communicating with the C2. We dubbed the first group of compromised devices “individual or small network infrastructure.” We suspect this pool is mostly routers such as MikroTik and DrayTek. The second cluster of targets is associated with “enterprise targets.” These primary targets correspond to organizations where we suspect that the actor would retrieve data.

Individual or small network infrastructure

The oldest activity dates to December 16, 2025, when we observed a spike in communications. We observed internet-wide scanning on port 161, associated with SNMP. We suspect they were attempting exploits against the SNMP service, which is designed for remote control of routers. Lumen observed bidirectional connections to over 150 unique IP addresses because of this scanning, which occurred on December 15 between 0730 and 2345 UTC. This group of 150 routers had sustained connections, indicating likely initial access and enumeration attempts.

Of this group of 150, we observed persistent connections from a handful of IP addresses communicating over the MQTT port (1883) with one of the active C2 nodes, 202.144.192[.]149. These IPs geolocated to Singapore, Cambodia and Vietnam, with the underlying devices primarily identified as MikroTik and DrayTek routers. The routers appear to be victims rather than relays because the BambooToken implant uses MQTT to communicate with the C2.

Lumen then observed a larger number of UDP-based connections associated with the MikroTik router, where the connection terminated at an IP address that geo-located inside China. When we looked at the other IP addresses, almost all terminating IPs were associated with a VPN service called “speedCN”. This application is described as a VPN service designed for overseas Chinese users that allows them to access Chinese websites without regional restrictions. It offers high-speed connectivity and a stable browsing experience, making it suitable for streaming, downloading and using various Chinese applications.

Lumen hypothesizes the purpose is to target the diaspora, who are physically located outside China but remain connected to the mainland ecosystem.

Enterprise targets

A review of the IP addresses communicating with the C2 nodes revealed a dozen compromised entities mostly located in Asia, with a handful in South America.

Most compromised servers were associated with mobile applications. While the countries aligned with the physical server locations, some apps—such as two related to cryptocurrency— likely targeted a worldwide audience. We identified one app connected to a chat service and another related to leisure and entertainment. We also noted an app linked to lifestyle and wellness management.

We identified two key software development entities: a GitLab server in Hong Kong and a Vietnamese company developing a portable lifestyle management device. We also noted targeting efforts toward a hotel in Vietnam, a biomedical company in Argentina, a legal firm in Chile, a cryptocurrency website in Lithuania and a Malaysian finance organization.

Chinese SoftEthernet victim

While reviewing connections to the C2 nodes, this connection stood out: a VPS labeled “SoftEthernet.”

Infected IP: 38.180.150[.]19
First seen: 2026-03-18 10:25:48
Last seen: 2026-07-27 20:02:22
Correlated country: Hong Kong, C2:202.144.192[.]149
X.509 fingerprint (fingerprint not observed on any other IP address on the internet): F6fe3856ba8c5e393a03575d2c1ca2e71e1cdbbb2d179c87e5da00d8ba7a24ef

The use of SoftEthernet, especially originating from Hong Kong, is a known TTP of various PRC-aligned actors. We ran a subsequent query for UDP-based connections to identify the victim connecting to the SoftEthernet node. The most prominent IP address in our telemetry was a China Mobile IP address. We suspect that this is the source of the infection, as we noted a time-series correlation between when the China Mobile IP address connected to the SoftEthernet node and when the SoftEthernet node communicated with the C2. At this time, we cannot determine the entity behind the China Mobile IP address.

What BambooToken signals for enterprise security teams

Historically, Lumen security efforts mainly focused on threats to internet service providers or activities affecting North America. However, we are now noticing a shift toward supply chain-style attacks, emphasizing the interconnected nature of the internet ecosystem. When an attacker gains access to a few systems, they can exploit trust relationships to spread further.

Due to limited targeting data and the popularity of these domains, we believe attackers gained broad access. They likely used this access to perform more targeted operations within specific networks. Nonetheless, threat actors rarely impersonate software linked to cryptographic tools used in secure environments like finance and government, so we have low confidence that these are their final targets.

Although skilled threat actors seldom make mistakes such as incorrect compilation flags, such errors do occur, revealing valuable capabilities. Once deployed, the malware’s uncanny features allow access to more protected network areas through tunneling and password extraction.

Based on our comprehensive findings, Lumen considers this threat actor highly dangerous. Using MQTT to control numerous clients from a central point, combined with routing via Cloudflare, enables large-scale operation through an unconventional communication method.

We believe this campaign's targeting supports extensive data collection. Mobile apps and smartwatches connected to cellular networks could enable pattern-of-life analysis, targeting financial organizations might expose transaction data, and attacking hospitality systems could reveal travel history and plans. We share this information to help others correlate similar campaigns and activities.

How enterprises can protect themselves

Black Lotus Labs has added the IoCs from this campaign into the threat intelligence feed that fuels the Lumen security solutions portfolio, and we continue to monitor the feed for new infrastructure, targeting activity and expanding TTPs. We will continue to collaborate with the security research community to share findings related to this activity and ensure the public is informed. We encourage the community to monitor for and alert on these and any similar IoCs. We also advise organizations to obtain a:

• Mapping of supply chains and their code dependencies, with a proper CI/CD pipeline.
• Router that is routinely patched. Properly configured to not respond to external requests via SNMP, this includes swapping out the default community strings and passwords. This could be augmented by outsourcing router management through secure routing.
• Well-tuned Endpoint Detection and Response (EDR) solution that routinely receives signature updates for all network assets, as well as centralized monitoring looking for signs of lateral movement within a network. This could be augmented with a service such as Automated Detection and Response (AMDR).
• Centralized firewall with a ruleset that looks for anonymous traffic. We recommend rulesets to detect abnormal protocols such as MQTT traversing outside of the network.
• View of large data transfers out of the network, even if the destination IP address is physically located in the same geographical area.

For additional IoCs associated with this campaign, please visit our GitHub page.

Indicators of compromise

Command and control IPs

202.144.192[.]23
ASN:63916, geo Japan
Port:1883 tagged MQTT
Port:2883 tagged MQTT
Port:63196 tagged as SSH
Dffa94a0f9c4dc38d475a32741f7f134cc934c7b98bec581c135da1b5aa1983f
January 20 to April 20th, 2026

210.1.226[.]238
Port:8883 tagged SSL MQTT
329f06012bca465dcaf1edbfdc20f1209b8ea00f269a8b890f165fb8c82c32d6
Port:63196 tagged as SSH
C4d4f8ccc9d2c4d289d8672396fdf0818b81551376057d43e76de66e29d73604

210.1.226[.]163
Port:63916 tagged as SSH
F8b8546daf5268e20e2ef7fe69c4442669c183c5c2b152bb11b23ad62ebcbd81
January 20 to April 20th, 2026

210.1.231[.]13
ASN:45785, geo Malaysia
Port:443
X.509 fingerprint sha256: 44e3580d84ba7534e815ae9c12c4165fbc9313adc7475808908fec26e9b17f19
Port:1883 tagged as MQTT
Port:63916 tagged as SSH
Ce4ce009fcebacf0b7e253409f1b192081b77f4d56bb3af0fa71d125aa060c51
Port:64332 likely staging port
5d06c1b06b48e9f61fec86179f194e0f611d6cf7495e0370a58844f0dddb437d
January 20 to April 20th, 2026
March 3, 2026, to July 2, 2026

202.144.192[.]149 - Japan
ASN:63916, geo Japan
Port:1883 tagged as MQTT
Port:2883 tagged as MQTT
Port 8883 tagged as SSL MQTT
329f06012bca465dcaf1edbfdc20f1209b8ea00f269a8b890f165fb8c82c32d6
Port:63916 tagged as SSH
SSH fingerprint:c4d4f8ccc9d2c4d289d8672396fdf0818b81551376057d43e76de66e29d73604

43.245.198[.]195
Port:1883 tagged MQTT
Port:63196 tagged as SSH
SSH fingerprint: Ca024caa58c1da0259157399c9f76d797b0148708628051ffdd465d5ff0feead
March 3, 2026, to July 2, 2026

43.245.198[.]238
Port:1883 tagged MQTT
Port:63196 tagged as SSH
SSH fingerprint: F8d57ed725f95f7784564a1bb1f5d9f7c3f6fc025ccc520188bccee0efd86a36
January 20 to July 2, 2026

Command and control domains

Hostnames and their corresponding Ips:
api80.c2iznja[.]com, 202.144.192[.]149
Newdma.c2iznja[.]com, 202.144.192[.]13
live-hk.c2iznja.com, 202.144.192[.]149
turbo.c2iznja[.]com, 210.1.231[.]13
base64.c2iznja[.]com, 202.144.192[.]149
Cache.c2iznja[.]com - Hidden behind Cloudflare
Apis.chat5188[.]tk - Hidden behind Cloudflare
Chat.chat5188[.]tk - Hidden behind Cloudflare
Api08.chat5188[.]tk - 210.1.226[.]236
Api06.chat5188[.]tk - Hidden behind Cloudflare

Explore additional threat resources

Please visit our GitHub page, which we update continuously. For broader threat protection and cybersecurity insights, explore these resources:

• Learn how we help protect customers with Lumen Defender^SM and Lumen Defender℠ Advanced Managed Detection & Response (AMDR)
• Read the Lumen Defender Threatscape Report to understand how modern cyberthreats are evolving.
• Collaborate with us on similar research by reaching out on LinkedIn or X (@BlackLotusLabs).

Analysis of BambooToken was performed by Danny Adamitis and Steve Rudd, with technical editing by Ryan English.

Stay ahead of emerging malware campaigns like BambooToken. Explore Black Lotus Labs threat research and solutions designed to help security teams detect covert C2 activity earlier and strengthen enterprise defense.

_{This content is provided for informational purposes only and may require additional research and substantiation by the end user. In addition, the information is provided "as is" without any warranty or condition of any kind, either express or implied. Use of this information is at the end user's own risk. Lumen does not warrant that the information will meet the end user's requirements or that the implementation or usage of this information will result in the desired outcome of the end user. All third-party company and product or service names referenced in this article are for identification purposes only and do not imply endorsement or affiliation with Lumen. This document represents Lumen products and offerings as of the date of issue. Services not available everywhere. Lumen may change or cancel products and services or substitute similar products and services at its sole discretion without notice. © 2026 Lumen Technologies. All Rights Reserved.}