Three Years Hidden, One File Operation Away From Prevention
Lumen’s Black Lotus Labs disclosed BambooToken malware on September 18-19, 2026, revealing a campaign that had been running undetected since at least February 2023. The malware compromised roughly a dozen organizations across Asia and South America — hotels, biomedical firms, law firms, financial institutions, and a GitLab server in Hong Kong that could have served as a supply-chain pivot point.
BambooToken stayed hidden by using two evasion techniques: routing command-and-control traffic over MQTT (the IoT messaging protocol that most network security tools don’t scrutinize), and delivering its payload via DLL sideloading through Tendyron’s OnKey software, a legitimately signed identity and authentication application. On Windows systems, the malicious library OnKeyToken_KEB.dll was placed alongside the legitimate signed executable OnKeySrv.exe, which then loaded the attacker’s code instead of its own.
That second technique — DLL sideloading — is where the attack is most vulnerable, and it’s where FileSure Defend would have stopped it cold.
DLL Sideloading Requires Writing a File to Disk First
DLL sideloading works because a malicious library sits on the file system next to a legitimate executable, waiting for that trusted program to load it. Before the sideload can happen, the malicious DLL has to land on disk. That means a file write operation — either from an email attachment, a compromised software update, lateral movement via SMB, or a dropper executable delivered through some other vector.
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts every file operation before it completes. You define rules that control which programs are allowed to write which types of files to which locations. Everything outside those rules is blocked at the kernel level, before the file ever touches the disk.
In the BambooToken case, the malicious OnKeyToken_KEB.dll had to be written to the system before OnKeySrv.exe could load it. FileSure would block that write operation if it came from an unauthorized source — whether that’s Outlook.exe saving an email attachment, a browser downloading a file, or a remote process writing to a network share.
The malicious library never lands. The sideload never happens. The malware never executes. The MQTT C2 channel never gets established because there’s no running malware to beacon out.
A Simple Rule That Stops a Three-Year Campaign
Here’s a FileSure rule configuration that would have blocked BambooToken’s delivery:
File Name Filter: *.dll
Program Name Filter (Deny): outlook.exe, msedge.exe, chrome.exe, firefox.exe, explorer.exe
Operations: Write, Create
Drive Type: Fixed Drive
Action: Deny
This rule blocks email clients, browsers, and Windows Explorer from writing DLL files to the local hard drive. Legitimate software installers and update mechanisms can be added to an allow list by specific executable path. Everything else — including a malicious DLL delivered via phishing, drive-by download, or lateral movement — gets blocked at the kernel level.
You don’t need to recognize the threat. You don’t need a signature update. You don’t need to wait for your vendor to analyze a new variant. The rule controls the operation, not the content.
Prevention Beats Detection When the Malware Hides for Years
Lumen’s researchers noted that BambooToken’s operators were skilled and patient, refining their techniques between 2024 and 2025 to reduce their detection footprint. They switched to MQTT for C2 specifically because network security tools weren’t watching for it. They used DLL sideloading through a signed binary because endpoint tools trust code signatures.
That’s the problem with detection-based security. Attackers iterate until they find the blind spot. BambooToken found two: an unmonitored network protocol and a trusted executable. Both worked for three and a half years.
FileSure doesn’t care what the network traffic looks like or whether the executable is signed. It controls file operations at the kernel level. If an unauthorized program tries to write a DLL to disk, the operation is blocked — whether it’s a known threat, a zero-day variant, or something nobody has ever seen before.
The malware can’t sideload if it never lands. It can’t establish C2 if it never runs. It can’t exfiltrate data, move laterally, or compromise a GitLab server if it’s stuck at the file write operation, blocked before it ever touches the file system.
FileSure Defend runs on all Windows versions from XP through Windows 11 and Server 2022, including the legacy systems that modern endpoint tools won’t protect. It integrates with your existing RMM, SIEM, and Splunk infrastructure, sending kernel-level file operation events directly to the tools your team already uses.
Start a free 21-day trial at bystorm.com and see how kernel-level file system control stops attacks that detection-based tools miss — including the ones hiding in your environment right now.
Source: BambooToken Malware: MQTT C2 Hid 3 Years [2026]
Category: Threat Intelligence
Tags: bambootoken, dll sideloading, mqtt c2, kernel filter driver, file system security, zero-day prevention, malware delivery
