Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
Summary: A Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to reboot it when defenders kill the main process, giving its other persistence mechanisms another chance to relaunch it. Nozomi Networks Labs, which observed the dropper reaching its honeypots via Telnet credential brute force, published the analysis on July 27, 2026, noting Tengu supports 25 DDoS methods, runs a SOCKS5 proxy, and carries a hardcoded list of reboot and shutdown utilities whose ELF headers it overwrites with the string ELFOOD.
Key Takeaway: Killing the malware process no longer ends the incident: a guardian checks every 60 seconds and a watchdog armed with an approximately 30-second timeout reboots the device, so a suspected machine must be cleaned of fake systemd services, init scripts, shell startup files, and cron paths before it returns to service. The analyzed sample also overwrites the reboot and shutdown utilities defenders rely on, and its C2 traffic at 64[.]89.163.8 over TCP port 9931 is sent in plaintext.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026