Tengu Botnet Uses Hardware Watchdog to Reboot Linux IoT Devices and Survive Defenders

Security researchers at Nozomi Networks Labs have uncovered a new Mirai-derived botnet dubbed Tengu that targets Linux-based IoT devices with an unusually resilient persistence architecture. The dropper reaches exposed endpoints primarily through Telnet credential brute-force attacks, exploiting devices that ship with default or weak administrative passwords. Once deployed, Tengu supports 25 distributed denial-of-service (DDoS) methods, can operate as a SOCKS5 proxy, execute arbitrary shell commands, and harvest system and network telemetry. Architecture-specific ELF samples were observed for i386, amd64, MIPS, ARM, PowerPC, and m68k processors, while the malware can also retrieve Android APK payloads from its command-and-control infrastructure. Defenders should run a password strength check on all device credentials and audit any default logins still in use.

What distinguishes Tengu from typical Mirai variants is its layered self-defense model. A forked guardian process polls the principal malware binary every 60 seconds and relaunches it if terminated, while the bot also creates fake systemd services, init/RC scripts, and altered shell startup files, and marks its installed binary as immutable. A cron-based persistence routine is present, though Nozomi noted its reference to /proc/self/exe appears unfinished. The most sophisticated mechanism abuses the device's hardware watchdog: a background worker masquerading as [kworker/0:0] reopens the watchdog device, arms it with an approximately 30-second timeout, and sends keepalive signals only while the main malware process remains alive. If defenders kill the process, the watchdog starves and forces a reboot, after which Tengu's other persistence mechanisms get a second chance to relaunch it. Tengu also carries a hardcoded list of reboot and shutdown utilities and overwrites their ELF headers with the string "ELFOOD," sabotaging the very commands responders typically use to recover compromised devices.

The analyzed sample communicates with a command-and-control server at 64[.]89.163.8 over TCP port 9931. Registration, heartbeat traffic, and command output travel in plaintext, while server commands and updates use a custom ChaCha20/Poly1305-like authenticated encryption scheme. Network defenders should verify exposure on this port using a port scanner and inspect traffic patterns for plaintext registration flows directed at the listed IP. Nozomi's report names no specific vendor or device model, operator, infection count, or confirmed DDoS victims, instead illustrating capability rather than current scale.

Mitigation guidance from Nozomi Networks Labs centers on reducing the initial attack surface and hardening persistence paths. Organizations should immediately remove internet exposure for Telnet and other unnecessary administrative services, rotate any default credentials, update firmware, segment IoT networks from production assets, and review systemd services, init scripts, shell startup files, and cron-related paths before returning a suspect device to service. Nozomi published its full technical analysis on July 27, 2026, emphasizing that Tengu's blend of watchdog abuse, immutable binaries, and tampered shutdown utilities sets a new bar for resilience among tracked Mirai variants.