- Security researchers at Nozomi Networks Labs discovered Tengu, a new Mirai-derived botnet that exploits Linux hardware watchdogs to reboot compromised devices when its main process is killed.
- Once rebooted, Tengu’s other persistence mechanisms can relaunch the malware, making it highly resilient to standard disruption tactics.
- The botnet supports 25 DDoS methods, runs a SOCKS5 proxy, executes shell commands, and can download additional ELF or Android payloads.
Researchers at Nozomi Networks Labs published their analysis of a new Mirai-derived botnet called Tengu on July 27, 2026, after observing it target Linux devices via Telnet credential brute force.
The malware stands out for its sophisticated self-defense mechanisms, including a hardware watchdog abuse that triggers a reboot when defenders kill its main process.
Tengu forks a detached guardian process that checks the principal malware every 60 seconds and relaunches it if it stops.
A second mechanism uses the device’s hardware watchdog, arming it with a 30-second timeout and sending keepalive signals only while the main process lives.
Kill the main process, and the watchdog triggers a reboot, allowing Tengu’s other persistence methods to try again.
The botnet also overwrites the ELF headers of system reboot and shutdown utilities with the string “ELFOOD,” interfering with normal shutdown commands.
Tengu includes a hardcoded command-and-control server at 64[.]89.163.8 over TCP port 9931, using plaintext for registration but a custom ChaCha20/Poly1305 scheme for server commands.
The malware can also retrieve content from an InterPlanetary File System (IPFS) gateway on the same server, validating it as an ELF or APK before execution.
Nozomi assessed the APK path likely targets Android TV boxes, according to its report, but did not document confirmed victims.
URLhaus independently recorded 17 malware URLs at the same IP address beginning June 17, 2026, including files tagged as Mirai and an APK, though it does not identify them as Tengu.
The researchers at Nozomi recommend removing internet exposure for Telnet, replacing default credentials, updating firmware, and segmenting IoT networks.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
