Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

Published:

28 juli 2026 om 15:01:33

Alert date:

28 juli 2026 om 16:04:03

Source:

thehackernews.com

Ransomware & Malware, Mobile & IoT, Operating Systems, Network Infrastructure

A new Mirai-derived botnet named Tengu has been discovered by Nozomi Networks Labs, targeting Linux devices through Telnet credential brute force. Tengu employs a novel persistence mechanism that leverages the hardware watchdog timer on compromised Linux devices to trigger a reboot when its main process is terminated by defenders. Upon reboot, additional persistence mechanisms are activated to relaunch the malware. The botnet supports 25 distributed denial-of-service (DDoS) attack methods, making it a significant threat. Its dropper was observed reaching honeypots via Telnet brute force. The use of hardware-level watchdog timers for persistence represents an advanced evasion technique that complicates incident response efforts.

Technical details

Tengu is a Mirai-derived botnet targeting Linux devices, first observed by Nozomi Networks Labs reaching honeypots via Telnet credential brute force. It supports 25 DDoS methods, a SOCKS5 proxy, shell command execution, system and network data collection, self-updating, and retrieval of additional ELF or APK payloads. Architecture-specific samples exist for i386, amd64, MIPS, ARM, PowerPC, and m68k. Persistence mechanisms include: (1) a detached guardian process that checks the main malware process every 60 seconds and relaunches it if stopped; (2) a fake systemd service; (3) init and RC scripts; (4) altered shell startup files; (5) marking its installed binary as immutable; (6) a cron-based persistence routine (noted as possibly unfinished); and (7) hardware watchdog abuse — a background worker masquerading as [kworker/0:0] reopens the watchdog device, arms it with ~30-second timeout, and sends keepalive signals only while the main process is alive — killing the process stops keepalives, causing the device to reboot and allowing other persistence mechanisms to relaunch Tengu. Additionally, Tengu carries a hardcoded list of reboot/shutdown utilities and overwrites their ELF headers with the string 'ELFOOD' to interfere with defenders' ability to restart or safely power down a compromised device. C2 communication occurs over TCP port 9931 to 64[.]89.163.8; registration, heartbeat, and command output are sent in plaintext, while server commands and updates use a custom ChaCha20/Poly1305-like authenticated encryption scheme. Tengu can also retrieve payloads via IPFS gateway on the same server (port 8080), validating results as ELF or APK before executing or installing them. The APK path is assessed to likely target Android TV boxes or similar devices. URLhaus recorded 17 malware URLs at 64[.]89.163.8 beginning June 17, 2026, including a shell script, multiple Mirai-tagged ELF files, and an APK.

Mitigation steps:

1. Remove internet exposure for Telnet and other unnecessary administrative services. 2. Replace default credentials on all devices. 3. Update device firmware to the latest versions. 4. Segment IoT networks to limit lateral movement. 5. Before returning a suspected device to service, review systemd services, init scripts, shell startup files, and cron-related paths for malicious entries. 6. Check for and remove fake systemd services, unauthorized init/RC scripts, and immutable file attributes on binaries. 7. Investigate hardware watchdog activity for signs of abuse. 8. Block or monitor traffic to 64.89.163.8 on TCP port 9931 and port 8080. 9. Look for processes masquerading as [kworker/0:0] and verify their legitimacy. 10. Scan ELF binaries for the header string 'ELFOOD' as an indicator of tampering. 11. Monitor for unexpected reboots on Linux/IoT devices which may indicate watchdog abuse.

Affected products:

Linux devices (general
across architectures: i386
amd64
MIPS
ARM
PowerPC
m68k)
IoT devices with hardware watchdog support
Android TV boxes and similar Android-based devices (suspected)