CuraSec

tag: Mqtt · 2 items

Plan archived BambooToken Malware Uses MQTT Protocol for Cross-Platform C2
2026-09-16 · The Hacker News · source ↗ #malware#mqtt#c2
  • Engineer — Learn: MQTT-as-C2 is a novel evasion technique worth understanding when designing network egress controls — consider whether MQTT traffic on port 1883/8883 to external brokers is permitted in your environment. No KEV listing, PoC, or evidence of exploitation outside Asia/South America campaigns.
  • SOC/IR — Plan: MQTT is rarely monitored in enterprise SIEMs, making it an effective detection gap; add a hunt for unexpected outbound MQTT connections (ports 1883/8883) to external broker IPs as a low-cost coverage improvement this quarter. No IOCs were published in the disclosed research.
  • Leader — Skip
Plan archived BambooToken malware uses MQTT protocol for Windows/Linux C2
2026-09-15 · BleepingComputer · source ↗ #malware#c2#mqtt
  • Engineer — Learn: MQTT as a C2 channel is an emerging evasion technique worth noting for threat modeling — if you run MQTT brokers or IoT infrastructure, review whether outbound MQTT to external brokers is permitted and consider blocking or monitoring it.
  • SOC/IR — Plan: Build or tune detections for MQTT (port 1883/8883) traffic from endpoints to external brokers as a C2 indicator; the summary lacks published IOCs, but MQTT is not typically monitored in most SIEM/EDR rulesets and this framework’s activity dates to 2023.
  • Leader — Skip