September 16, 2026
- BambooToken uses MQTT for C2 across Windows and Linux systems. Lumen Black Lotus Labs traces the activity from February 2023 through July 2026, including infections associated with backend services and a GitLab instance across Asia and South America. The Windows agent was sideloaded by Tendyron OnKey; a Linux sample first observed in December 2025 still appeared to be under development (Lumen). · Threat Activity & Malware
in CVE-2026-76461 Gives Remote Attackers Root on Cisco Email Gateways