Detection of Unauthorized External MQTT Broker Connections

The MQTT (Message Queuing Telemetry Transport) protocol is increasingly utilized by threat actors for command and control (C2) communication due to its lightweight publish/subscribe architecture. Malware such as BambooToken, IOCONTROL, MQsTTang, and WailingCrab leverage MQTT to receive commands and exfiltrate data while masking traffic within typical IoT or application messaging flows. Attackers commonly target TCP ports 1883, 2883, and 8883 for these connections. Defenders can identify this activity by monitoring network telemetry for first-seen connections to external MQTT brokers.

Detection requires deep packet inspection (DPI) or protocol-aware security sensors to decode MQTT traffic. Without SSL/TLS decryption, encrypted sessions may only be classified generically as SSL/TLS, limiting visibility. Defenders should correlate these network connections with endpoint activity, specifically looking for unsigned binaries or persistence mechanisms such as BambooToken's associated files: OnKeySrv.exe, OnKeyToken_KEB.dll, and OnKeySrv.dat.

Impact

Successful exploitation allows attackers to establish persistent, stealthy C2 channels that bypass traditional direct-connect detection methods. The use of MQTT enables the deployment of modular plugins and the remote execution of commands, potentially leading to unauthorized data exfiltration, system manipulation, or further lateral movement within the network. Sectors relying heavily on IoT infrastructure are particularly vulnerable to this communication pattern.

Recommendation

• Implement the provided detection logic to surface first-seen connections to external MQTT brokers using Suricata, Zeek, or PAN-OS logs.
• Review all flagged connections to determine if the originating asset is an authorized MQTT client.
• Correlate network alerts with endpoint telemetry, specifically investigating unauthorized MQTT-capable processes, shell execution, or suspicious DLL loads (e.g., OnKeySrv.exe).
• Restrict outbound MQTT traffic to verified broker addresses and ports (e.g., 1883, 2883, 8883) where operational requirements permit.
• Validate that network sensors are positioned to observe traffic before Source NAT to ensure visibility into the originating internal IP.