Researchers at Black Lotus Labs detailed BambooToken, a stealthy malware framework active since at least 2023 that controls infected Windows and Linux systems using MQTT, a lightweight messaging protocol designed for internet-of-things devices. Instead of connecting directly to attacker servers, infected machines subscribe to topics on a message broker, and operators publish commands to them, which helps evade detection and keeps working through network disruptions. The malware is installed by side-loading a malicious library through a legitimately signed USB-token tool or by impersonating office software. It compromised about a dozen enterprises, including a source-code server, and researchers note that command-and-control over an uncommon protocol like MQTT is an easy blind spot.
LevelBlue detailed QuimaRAT, a new Java-based remote access trojan sold as a service that runs across Windows, Linux, and macOS from the same codebase. Subscriptions range from about $150 for a month to $1,200 for lifetime access, lowering the bar for attackers to get cross-platform reach. Built around a modular design, it expands its capabilities through encrypted plugins that operators can load, update, or remove from their command server on the fly. It also uses several obfuscation techniques to keep changing how it looks to security tools without altering its behavior, so signatures based on its appearance are likely to go stale quickly.
TrustStrike Labs