Researchers at Nozomi Networks Labs have documented a new botnet, named Tengu, that goes further than most Mirai variants in resisting removal from compromised Linux and IoT devices. Its standout feature is abuse of the Linux hardware watchdog: a background worker inside the malware reopens the watchdog device and keeps feeding it “heartbeats” every 60 seconds. If a defender kills the main Tengu process, those heartbeats stop arriving — and the device’s hardware watchdog triggers a forced reboot. When the device comes back up, Tengu’s other persistence mechanisms get another chance to relaunch the malware before a defender can intervene.
Beyond the watchdog trick, Tengu layers several additional persistence techniques: a fake systemd service entry, init and RC scripts, modified shell startup files, and a cron-based routine. After installation, the bot also forks a detached “guardian” process that checks on the main malware process every 60 seconds and relaunches the installed binary if it has stopped — providing a second line of defense even without the watchdog. On the attack side, Tengu supports 25 distinct DDoS methods, runs a SOCKS5 proxy, executes arbitrary shell commands, and can collect system and network information. It is capable of self-updating and fetching additional ELF or Android APK payloads. Architecture-specific samples have been identified for i386, amd64, MIPS, ARM, PowerPC, and m68k — covering virtually the entire breadth of Linux-capable IoT hardware. Nozomi observed the dropper reaching its honeypots through Telnet credential brute force, consistent with Mirai’s standard initial-access playbook.
Nozomi’s report does not name a specific operator or provide infection counts, and no real-world DDoS victims have been identified publicly. The analysis focuses on capability rather than scale, and Nozomi notes that “most Mirai variants implement few, if any, of these self-defense capabilities.” For defenders, the immediate priority is eliminating the initial-access path: remove Telnet exposure, rotate default credentials, and update device firmware. Before returning a suspected compromised device to service, Nozomi recommends reviewing systemd services, init scripts, shell startup files, and cron entries for unexpected Tengu-related entries.
Sources
- Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process — The Hacker News
- Nozomi Networks Labs Tengu analysis (published July 27, 2026)