Tengu Botnet Reboots Linux Devices When Defenders Kill Its Process

Researchers at Nozomi Networks Labs have detailed a new botnet, Tengu, descended from the infamous Mirai. What sets it apart is not so much its feature set as its persistence: the authors equipped the malware with a whole arsenal of self-defense and system-persistence mechanisms. According to the analysts, most Mirai variants get by with a bare minimum of such tricks — against that backdrop, Tengu stands out noticeably. The report was published on July 27, 2026.

How it stays put

Tengu reaches devices by brute-forcing Telnet credentials — that is exactly how the dropper found its way into Nozomi's honeypots. Once established, it spawns a separate “watchdog” process that checks every 60 seconds whether the main malware is still alive and restarts it if necessary. On top of that, Tengu can create a fake systemd service, plant itself in init and RC scripts, alter shell startup files, and make its own binary immutable. A stub for persistence via cron is also present but, by all appearances, was left unfinished.

The most ingenious trick involves the hardware watchdog. A background thread masquerades as the system process [kworker/0:0], opens the watchdog device, arms the timer for roughly 30 seconds, and sends it “I'm alive” signals — but only while the malware's main process is running. The moment a defender kills that process, the watchdog stops receiving confirmations and takes the device into a reboot. And after the reboot, the other persistence mechanisms come back into play. In addition, Tengu corrupts the headers of the standard reboot and shutdown utilities, overwriting them with the string ELFOOD to keep the administrator from properly restarting or powering down the infected machine.

Capabilities and infrastructure

The botnet supports 25 DDoS attack methods, can spin up a SOCKS5 proxy, run shell commands, and gather system and network data. It is able to update itself and pull down additional payloads in ELF or APK format, including via an IPFS gateway. The presence of APK, in Nozomi's assessment, hints at a hunt for poorly secured Android-TV boxes, though the researchers found no confirmed Android victims. Samples were collected for a wide range of architectures — i386, amd64, MIPS, ARM, PowerPC, and even m68k.

The sample studied contacted a C2 server at 64[.]89.163.8 on port 9931; the service traffic runs in cleartext, while the server's commands are protected by a scheme based on ChaCha20/Poly1305.

An important caveat: the report shows what Tengu is capable of, but not how widespread it is. Nozomi names no specific devices, operators, infection counts, or real DDoS victims. The URLhaus service independently logged 17 malicious URLs at the same address starting June 17, but by July 28 all of them were already unavailable, and their hashes did not match Nozomi's sample.

Defenders are advised to start with the basics: remove Telnet and unneeded administrative services from public exposure, change default passwords, update firmware, segment IoT networks, and — before returning a suspect device to service — check systemd services, init scripts, startup files, and cron.

Source: The Hacker News