Tengu Botnet Turns Linux Devices Against Their Own Defenders
A new Mirai spin-off reboots infected machines when responders try to shut it down, giving its persistence tricks another shot at survival.
Key points
- Nozomi Networks Labs identified a new Linux botnet called Tengu, built on the Mirai code base.
- Tengu abuses the hardware watchdog on infected Linux devices to force a reboot when defenders kill its process.
- The malware spreads by guessing Telnet login details on internet-exposed devices.
- Tengu supports 25 different types of distributed denial-of-service attacks, which flood websites and services with junk traffic.
- Nozomi first observed the malware through its honeypot systems, which are decoy machines set up to attract attackers.
Researchers at Nozomi Networks Labs have flagged a fresh strain of Linux malware that fights back when responders try to remove it. They call it Tengu.
The botnet is descended from Mirai, the notorious 2016 malware that hijacked home routers and cameras to knock major websites offline. Tengu keeps Mirai's flooding tricks and adds a nasty twist for anyone trying to clean an infected machine.
What makes Tengu different from other Mirai copies?
It uses the device's own hardware watchdog to reboot the machine when defenders kill the malware. A watchdog is a small built-in timer that Linux devices use to restart themselves automatically if they freeze. Tengu tells the watchdog to reboot the device the moment its main process dies.
That reboot buys the malware a second chance. Tengu plants several other persistence hooks on the device, meaning ways to relaunch itself after a restart. Kill the running process and the machine reboots straight into a fresh infection.
For a defender, this turns a routine clean-up into a game of whack-a-mole. The usual first move, killing the bad process, becomes the trigger for reinfection.
How does Tengu get onto a device in the first place?
Through weak Telnet passwords. Nozomi's honeypots, which are decoy servers designed to lure attackers, were hit by a dropper that guessed Telnet login details in bulk. Telnet is an older way to log into a device remotely, and many cheap routers, cameras and industrial gadgets still leave it switched on with default credentials like admin/admin.
Once inside, the dropper installs the Tengu binary and wires up the persistence and watchdog tricks.
What does Tengu do once it is running?
It turns the device into an attack drone. The malware supports 25 different distributed denial-of-service (DDoS) methods, according to the write-up first published by The Hacker News. A DDoS attack drowns a target site or service in fake traffic until real users cannot get through.
Each infected device becomes one small pipe in a much larger flood. Owners rarely notice, because the device keeps doing its day job, just slower and with a heavier internet bill.
| Detail | What Nozomi reported |
|---|---|
| Botnet name | Tengu |
| Base code | Mirai |
| Target systems | Linux devices |
| Entry method | Telnet brute force |
| DDoS methods supported | 25 |
| Signature trick | Watchdog-triggered reboot on process kill |
Should ordinary people worry?
Most home users will not spot Tengu directly, but the devices it targets sit in millions of homes and small offices. Old routers, IP cameras and DVRs are the usual victims.
Two practical steps help. Change any default password on internet-connected gadgets, and switch off Telnet in the device's admin settings if you see the option. If a router feels sluggish or runs hot for no reason, a factory reset followed by a firmware update is a reasonable move.
What should defenders do differently?
Do not lead with a process kill. On a device suspected of Tengu infection, responders should isolate the machine from the network first, disable the watchdog timer where possible, and only then remove the malware and its persistence entries. A straight kill command will trip the reboot and undo the work.
