Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

# The Botnet That Weaponizes Your Own Hardware Against You

When a responder kills a malicious process, the instinct is sound: stop execution, contain the damage, investigate. Tengu was built to punish that instinct.

Researchers at Nozomi Networks Labs published an analysis Monday of a Mirai-derived botnet with a self-defense mechanism that turns standard incident response against the defender. Kill Tengu's main process and the device reboots — not because something went wrong, but because the malware engineered it that way. When the machine comes back up, Tengu's persistence layers try to relaunch it. You just handed the malware a second chance.

That's the hook. The rest of the technical picture is equally deliberate.

## How the Watchdog Becomes a Weapon

Linux and embedded systems ship with a hardware watchdog — a timer the OS must periodically reset or the hardware triggers a reboot. It exists to recover from kernel panics and hung systems. Tengu found a different use for it.

A background worker thread masquerades as [kworker/0:0], a generic kernel process name that blends into normal system listings. This thread opens the watchdog device, arms it with a roughly 30-second timeout, and sends keepalive signals continuously — but only while the main malware process remains alive. The thread and the process are linked. Kill the process, the keepalives stop. Thirty seconds later, the hardware watchdog fires. The machine reboots.

That reboot isn't an accident or a failure. It's a designed feature. Once the system comes back up, Tengu's other persistence mechanisms — fake systemd services, modified init and RC scripts, altered shell startup files — get another crack at relaunching the binary.

The redundancy here is intentional and layered. Nozomi documented a guardian process that forks off as a detached daemon and checks for the principal malware process every 60 seconds, relaunching the installed binary if it finds it gone. There's a cron-based persistence routine as well, though Nozomi noted its reference to /proc/self/exe looks unfinished or broken — possibly a development artifact. Even when one layer fails, others wait.

## Poisoning the Exits

The hardware watchdog trick is clever. The next technique is nastier.

Tengu carries a hardcoded list of common reboot and shutdown utilities. It overwrites their ELF headers with the string ELFOOD. The result: those binaries no longer execute correctly. A responder who kills the malware process, watches their device reboot unexpectedly, and then tries to power the machine down cleanly — using the tools they've always used — may find those tools don't work as expected.

Tengu isn't just persisting. It's degrading the responder's ability to control the situation. The sequence is a trap: the expected response triggers the watchdog reboot, and the tools for orderly shutdown have been quietly sabotaged in the background.

This combination — hardware watchdog rearming, poisoned system utilities, multi-layer persistence — is what made Tengu stand out to Nozomi's researchers. "Most Mirai variants implement few, if any, of these self-defense capabilities," they wrote. The Mirai lineage is old, but it keeps finding new engineers.

## The Full Capability Set

Self-defense mechanisms aside, Tengu is a functional botnet with a standard-issue toolkit. It supports 25 DDoS methods, can run a SOCKS5 proxy, execute shell commands, and collect system and network data. It can update itself and retrieve additional payloads — either ELF binaries for Linux targets or APK packages, which Nozomi assessed likely target Android TV boxes or similar under-secured devices.

The architecture-specific samples cover i386, amd64, MIPS, ARM, PowerPC, and m68k — a breadth that signals IoT intent. MIPS and ARM dominate embedded hardware: routers, IP cameras, NAS devices, set-top boxes. The m68k sample is unusual; that architecture shows up in older industrial equipment and some network appliances.

Initial access arrives via Telnet credential brute force — the same 2016-era vector that built the original Mirai botnet. After nearly a decade, Telnet exposure and default credentials remain a viable attack path because millions of devices still ship that way and never get reconfigured.

## The C2 Architecture

The command-and-control server sits at 64[.]89.163.8 on TCP port 9931. The design shows some thought: registration traffic and heartbeats run in plaintext, but actual commands and updates use a ChaCha20/Poly1305-like authenticated encryption scheme. A defender sniffing traffic can see a device is infected but can't easily decode what instructions it's receiving.

Tengu can also pull payloads through IPFS — the decentralized file system — using a gateway running on the same server. An operator provides a content identifier; the malware fetches, validates, and executes the payload. IPFS-based payload delivery has appeared in other malware families over the past two years. The appeal is resilience: traditional C2 domains can be sinkholes, CDN-hosted payloads can be taken down, but IPFS content identifiers point to distributed storage that's harder to remove.

URLhaus independently logged 17 malware URLs at the same IP address beginning June 17, 2026 — shell scripts, Mirai-tagged ELFs, and an APK. As of Monday, all 17 were offline. URLhaus's hashes didn't match Nozomi's analyzed sample, which suggests either active development producing variant builds or different campaigns sharing the same infrastructure. The C2 going dark around the time of publication is consistent with an operator burning infrastructure after seeing disclosure.

## What Defenders Actually Need to Do

Nozomi's remediation guidance is practical and specific. Removing Tengu from a compromised device requires checking more than just the running processes. The persistence surface includes:

The watchdog complication means responders should be prepared for unexpected reboots during remediation and should verify persistence mechanisms are cleared before the device is considered clean. Factory resetting is cleaner than manual removal if the hardware supports it.

The front door remains the same one Mirai kicked open years ago: exposed Telnet, default credentials. Closing those requires no detection capability — just configuration discipline.

## HackWire Analysis

What Tengu illustrates isn't a new class of malware. It's a maturing one.

The hardware watchdog technique has appeared in academic IoT security research and in more targeted intrusion tooling, but its presence in a mass-deployment botnet is a meaningful step. Threat actors operating at the lower end of the sophistication spectrum are incorporating techniques that, five years ago, you'd associate with more advanced campaigns. The bar for "commodity botnet" is rising.

The anti-remediation design reveals something about the adversarial model. Botnet operators increasingly assume defenders will find and kill their processes. The watchdog trick, the persistence layers, the poisoned shutdown utilities — these aren't features for evading initial detection. They're features for surviving incident response. That's a different threat model than traditional Mirai variants, which mostly relied on sheer infection volume to compensate for easy removal.

The IPFS payload delivery is worth watching separately. A handful of malware families have adopted it over the past 24 months. It hasn't become dominant, but it's becoming normalized in threat actor toolkits. Defenders whose network monitoring is tuned for traditional HTTP/HTTPS C2 traffic or known-bad domains will miss IPFS-based payload retrieval unless they're specifically looking for it.

The honest caveat: Nozomi's report is a capability analysis from honeypot observation. There's no victim count, no confirmed DDoS target, no operator attribution. The C2 infrastructure was offline by the time the report published. Whether Tengu represents an active large-scale campaign or a functional but limited deployment remains unknown. That doesn't make the technical analysis less useful — defenders need to understand the capability regardless of current scale — but it should calibrate how urgently organizations treat it versus more confirmed threats.

The Mirai lineage keeps producing variants because the underlying conditions — internet-exposed Telnet, unconfigured default credentials, unpatched firmware — keep persisting. Tengu is a symptom of infrastructure we've collectively failed to clean up.

— HackWire Editorial

## Related Coverage