Tengu Botnet Turns Linux Devices Against Their Own Defenders
A new Mirai spin-off reboots infected machines when responders try to shut it down, giving its persistence tricks another shot at survival.
Key points
- Nozomi Networks Labs identified a new Linux botnet called Tengu, built on the Mirai code base.
- Tengu abuses the hardware watchdog on infected Linux devices to force a reboot when defenders kill its process.
- The malware spreads by guessing Telnet login credentials on internet-exposed devices.
- Tengu supports 25 different distributed denial-of-service methods, flooding targets with junk traffic until legitimate users can't get through.
- Nozomi first caught the malware through honeypot systems, decoy machines set up to attract attackers.
Researchers at Nozomi Networks Labs have flagged a fresh Linux malware strain that fights back when responders try to remove it. They call it Tengu.
The botnet descends from Mirai, the notorious 2016 malware that hijacked home routers and cameras to knock major websites offline. Tengu keeps Mirai's flooding tricks and adds a nasty twist for anyone trying to clean an infected machine. We've tracked the Mirai family since our first story on 28 May 2026, and Tengu is the most defensively aware variant we've reported on.
What makes Tengu different from other Mirai copies?
It weaponises the device's own hardware watchdog. A watchdog is a small built-in timer that Linux devices use to restart themselves automatically if they freeze. Tengu instructs the watchdog to reboot the machine the moment its main process dies, then relies on the other persistence hooks it planted to relaunch the infection after that restart.
Kill the process. The machine reboots. The malware comes back. For a defender, the usual first move becomes the trigger for reinfection, which is the detail worth sitting with here.
How does Tengu get onto a device in the first place?
Through weak Telnet passwords. Nozomi's honeypots were hit by a dropper that guessed Telnet credentials in bulk. Telnet is an older remote-login protocol, and many routers, cameras and industrial gadgets still leave it running with default credentials. Once inside, the dropper installs the Tengu binary and wires up the watchdog and persistence tricks.
What does Tengu do once it is running?
It turns the device into an attack drone. The malware supports 25 different DDoS methods, according to Nozomi's write-up. A DDoS attack drowns a target in fake traffic until real users can't connect.
Owners rarely notice. The device keeps doing its job, just slower and with a heavier bandwidth bill.
| Detail | What Nozomi reported |
|---|---|
| Botnet name | Tengu |
| Base code | Mirai |
| Target systems | Linux devices |
| Entry method | Telnet brute force |
| DDoS methods supported | 25 |
| Signature trick | Watchdog-triggered reboot on process kill |
Should ordinary people worry?
Most home users won't spot Tengu directly, but the devices it targets sit in millions of homes and small offices. Two practical steps help: change any default password on internet-connected gadgets, and disable Telnet in the device's admin settings if the option is there. A sluggish or overheating router is worth a factory reset followed by a firmware update.
What should defenders do differently?
Don't lead with a process kill. On a device suspected of Tengu infection, responders should isolate the machine from the network first, disable the watchdog timer where possible, and only then remove the malware and its persistence entries. A straight kill command trips the reboot and undoes the work.
The broader pattern is what I'd watch: botnet authors are now designing around the defender's standard playbook. Tengu isn't the last variant that'll do this.
