Plan
active
BambooToken malware uses MQTT protocol for Windows/Linux C2
- Engineer — Learn: MQTT as a C2 channel is an emerging evasion technique worth noting for threat modeling — if you run MQTT brokers or IoT infrastructure, review whether outbound MQTT to external brokers is permitted and consider blocking or monitoring it.
- SOC/IR — Plan: Build or tune detections for MQTT (port 1883/8883) traffic from endpoints to external brokers as a C2 indicator; the summary lacks published IOCs, but MQTT is not typically monitored in most SIEM/EDR rulesets and this framework’s activity dates to 2023.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.