Tengu: new Linux botnet abuses hardware watchdog to become unstoppable

Introduction

On July 27, 2026, researchers at Nozomi Networks published an analysis of a new botnet dubbed Tengu, the latest evolution of the infamous Mirai. The malware spreads via brute‑force attacks on Telnet and targets internet‑exposed Linux devices — routers, IP cameras, Android TV boxes — arming itself with an arsenal of 25 DDoS techniques, a SOCKS5 proxy, command execution, data collection, and self‑updating. Its real novelty, however, is a multi‑layered persistence system that goes so far as to co‑opt the device’s hardware watchdog, making the infection exceptionally difficult to eradicate.

Technical Analysis

Tengu is a modular malware compatible with i386, amd64, MIPS, ARM, PowerPC, and m68k architectures. After brute‑forcing weak or default Telnet credentials, it downloads the main payload and contacts the C2 server at 64[.]89.163.8 on port 9931. Registration and heartbeat travel in cleartext, while commands and updates are encrypted with a custom scheme reminiscent of ChaCha20/Poly1305. To distribute additional modules, Tengu leverages an IPFS gateway hosted on the same server, increasing download resilience.

Operational Capabilities

• 25 DDoS methods both volumetric and application‑layer.
• SOCKS5 proxy to anonymize malicious traffic.
• Arbitrary shell command execution with root privileges.
• Data collection from system and network (fingerprinting).
• Self‑updating and download of additional payloads, including ELF files for Linux and APK for Android (useful for compromising smart TV boxes or similar devices).

Redundant Persistence Tengu relies on at least five persistence anchors:

1. Guardian process – checks the main process every 60 seconds and restarts it if absent.
2. Fake systemd service and init/RC scripts placed in standard system paths.
3. Modification of shell startup files (.bashrc, .profile, etc.) to execute the malware at every login.
4. Immutable attribute – the malicious binary is marked with chattr +i, preventing accidental deletion.
5. Cron job (likely incomplete in the analyzed samples) for periodic restart.

Hardware Watchdog Abuse The most ingenious trick lies in the hardware watchdog, a physical timer that forces a system reboot if the kernel stops “feeding” it (typically by writing to /dev/watchdog). Tengu creates a fake kworker process that keeps the watchdog alive only while the malware is running. If an administrator spots and kills the malicious process, the watchdog is no longer fed and, after approximately 30 seconds, triggers a forced reboot. At boot, the other persistence mechanisms bring the infection back to life, thwarting superficial removal attempts.

System Command Sabotage To further hinder manual recovery, Tengu overwrites the ELF headers of critical executables such as reboot, shutdown, and similar with the string “ELFOOD”. The commands become unusable, leaving the administrator without tools for a controlled reboot.

Impact

At the time of analysis (late July 2026), no mass infections or direct DDoS attacks attributable to Tengu were observed. Nevertheless, its capabilities raise serious concerns: compromised devices can be recruited into DDoS botnets, used as proxies for illicit activities, exposed to data exfiltration, and turned into distribution points for additional malware (including malicious APKs). The extreme resilience complicates remediation efforts and prolongs the attacker’s dwell time. URLhaus has listed 17 malicious URLs linked to the C2 IP since June 17, 2026, all offline as of July 28; however, a direct correlation with the Tengu samples has not been confirmed.

Mitigation

Defense hinges on prevention and meticulous removal.

Prevention

• Disable internet access to Telnet and any other non‑essential administrative services.
• Replace all default credentials with strong, unique passwords.
• Regularly update firmware and isolate IoT devices on segmented networks (dedicated VLANs).

Remediation In case of suspected compromise, before returning the device to service:

• Inspect and clean systemd services (/etc/systemd/system/), init scripts (/etc/init.d/), shell configuration files (.bashrc, .profile, /etc/profile, etc.), and cron entries (/etc/cron*, /var/spool/cron).
• Check for immutable attributes with lsattr and remove them (chattr -i).
• Restore damaged system executables, for example by restoring from backup or reinstalling the original package.
• Monitor traffic to 64[.]89.163.8 and the SHA‑256 hashes published by Nozomi (currently no matching hashes appear in URLhaus databases).

FAQ

1. What is the Tengu botnet and how does it spread? Tengu is a variant of the Mirai malware that attacks Linux/IoT devices with weak credentials over Telnet. Once installed, it provides multiple functions (DDoS, proxy, command execution) and employs an extremely tenacious persistence system, including abuse of the hardware watchdog.

2. Why does the hardware watchdog make Tengu so hard to remove? The malware creates a fake kworker process that feeds the watchdog only while the malicious process is active. If it is terminated, the watchdog receives no more signals and forces a device reboot after about 30 seconds. Upon reboot, the other persistence mechanisms (scripts, cron, systemd) restore the infection, making simple binary deletion insufficient.

3. How can I protect my devices from this threat? The first line of defense is to disable internet exposure of Telnet and other administrative services, use strong passwords, keep firmware updated, and segment IoT networks. In case of suspected infection, a deep cleaning is necessary to remove all anchors (systemd, init, shell, cron) and restore altered system commands.