Affected Systems

Windows and Linux systems, particularly organizations in Asia and South America. Targets include financial, government, mobile app developers, and various enterprises. Campaign active since February 2023 through July 2026. Exploits Tendyron OnKey software via DLL sideloading (OnKeyToken_KEB.dll).

Exploitation Status

Active exploitation confirmed. Campaign detected from February 2023 through July 2026, with samples uploaded to VirusTotal as recently as December 2025. Multiple compromised entities identified across Asia (Singapore, Cambodia, Vietnam, Hong Kong, Malaysia, Lithuania) and South America (Argentina, Chile). No public PoC available, but malware samples exist on VirusTotal.

Business Impact

Multi-year campaign targeting high-security environments using legitimate Tendyron PKI authentication software (190 million tokens in circulation). Threat actor uses DLL sideloading to evade EDR detection and MQTT protocol for C2 communication. Malware collects extensive host information, enumerates installed antivirus products via WMI, and supports plugin architecture for extensibility. Compromised infrastructure includes MikroTik and DrayTek routers, GitLab servers, mobile app backends, and financial organizations. China-nexus suspected based on DLL sideloading TTPs and SoftEther VPN usage. C2 domains reached top 500K on Cloudflare Radar, indicating widespread infection.

Urgency

đźź  Within 24 hours

Recommended Actions

  • Hunt for DLL sideloading activity involving Tendyron OnKey software, specifically rogue OnKeyToken_KEB.dll files loaded by OnKeySrv.exe processes
  • Monitor and block network connections to known C2 infrastructure: chat5188[.]tk and api80.c2iznja[.]com, and inspect MQTT protocol traffic (typically port 1883/8883) for anomalous publish-subscribe patterns
  • Review EDR and endpoint logs for PowerShell scripts allocating memory and executing unsigned binaries, particularly in environments with Tendyron PKI tokens deployed
  • Inspect MikroTik and DrayTek routers for compromise indicators, including unexpected outbound MQTT connections and SoftEther VPN tunnels to unknown VPS providers
  • Query WMI event logs (namespace root\SecurityCenter2) for unusual antivirus enumeration activity and correlate with network connections to Cloudflare-proxied domains in the top 500K ranking

---

# Geopolitical Context

Geopolitical Context

The BambooToken campaign, active since February 2023, represents a sophisticated multi-platform intrusion effort targeting organizations across Asia and South America. The malware exploits Tendyron OnKey authentication software—a PKI token system widely deployed in China's financial and government sectors—through DLL sideloading techniques. The use of MQTT, an IoT messaging protocol, for command-and-control mirrors tactics previously observed in Chinese APT operations, notably Mustang Panda's MQsTTang backdoor which emerged concurrently in early 2023. Victim infrastructure includes mobile application servers, financial institutions, legal firms, and critical technology providers across at least eight countries, suggesting either broad opportunistic targeting or intelligence collection aligned with regional economic and strategic interests. The campaign's technical sophistication, multi-year persistence, and targeting profile are consistent with state-aligned espionage operations rather than financially motivated cybercrime.

State Actor Alignment

Technical indicators point to a possible China nexus, though no formal attribution has been established. Evidence includes: (1) exploitation of Tendyron software predominantly used by Chinese government and financial institutions; (2) malware samples uploaded primarily from Chinese IP address space; (3) use of DLL sideloading and SoftEther VPN—techniques commonly associated with Chinese APT groups; and (4) temporal correlation with Mustang Panda's MQsTTang malware, which also leveraged MQTT for C2 beginning in early 2023. However, researchers have identified no direct operational overlap between BambooToken and known Chinese threat actors. The campaign's focus on Asian financial institutions, government-adjacent infrastructure, and South American targets aligns with broader patterns of Chinese economic and strategic intelligence priorities, particularly in regions participating in Belt and Road Initiative partnerships or possessing strategic resources.

Business Impacty pro region

The campaign's geographic distribution reflects evolving threat landscapes in the Indo-Pacific and Latin America. In Asia, compromised infrastructure spans Singapore, Cambodia, Vietnam, Hong Kong, and Malaysia—jurisdictions serving as regional financial hubs and technology corridors. The targeting of mobile application servers and a GitLab development platform suggests supply chain risk and potential for downstream compromise of end users. In South America, victims in Argentina and Chile—both copper-rich nations with growing Chinese investment—may indicate economic intelligence collection. The compromise of MikroTik and DrayTek routers as C2 infrastructure demonstrates exploitation of widely deployed edge devices in developing markets with limited cybersecurity resources. For European entities, the Lithuanian cryptocurrency platform compromise illustrates spillover risk from campaigns nominally focused on other regions. The multi-year persistence and recent expansion to Linux systems in December 2025 suggest ongoing operational investment and adaptation.

Forecast

If BambooToken operators maintain current operational security and continue leveraging legitimate software for sideloading, detection and remediation efforts are likely to remain challenging for under-resourced organizations in target regions. The malware's expansion to Linux platforms suggests further cross-platform development is probable, potentially targeting cloud infrastructure and containerized environments. If the campaign is state-aligned, targeting patterns may intensify around geopolitical flashpoints—particularly in Southeast Asia amid South China Sea tensions or in Latin America as great power competition for resources and influence accelerates. Organizations using Tendyron authentication systems or similar PKI tokens should anticipate heightened scrutiny and potential for similar supply chain exploitation. If MQTT-based C2 proves operationally effective, adoption by additional threat actors is likely, particularly for targeting IoT and OT environments where the protocol is natively deployed. Defensive measures should prioritize monitoring for anomalous MQTT traffic, validating DLL integrity for authentication software, and implementing network segmentation to limit lateral movement from compromised edge devices.