Loading malware…
Tengu is a Mirai-derived botnet malware family targeting Linux-based IoT and embedded devices across multiple CPU architectures, including x86, MIPS, ARM, PowerPC, and m68k. It has been observed spreading through Telnet credential brute-forcing and retains core Mirai botnet functionality while adding more advanced persistence, self-defense, and post-compromise capabilities than are typical of many Mirai variants.
On compromised devices, Tengu supports distributed denial-of-service operations through numerous attack methods and can also operate a SOCKS5 proxy, execute shell commands, collect host and network information, update itself, and retrieve additional payloads. Reported payload handling includes both ELF binaries and APK packages, suggesting interest in Linux-based embedded systems and potentially Android-based smart devices such as TV boxes, although confirmed Android infections have not been established.
A defining characteristic of Tengu is its layered persistence and anti-removal design. It uses guardian-style monitoring to relaunch its main component if terminated, establishes persistence through fake service artifacts and startup-script modifications, and can harden its installed binary against deletion. Its most distinctive mechanism is abuse of the Linux hardware or software watchdog: a background component masquerading as a kernel worker thread refreshes the watchdog only while the malware remains active. If defenders kill the main malware process, watchdog servicing stops, causing the device to reboot and allowing Tengu’s persistence mechanisms to restore the infection after startup.
Tengu also interferes with remediation by corrupting reboot- and shutdown-related system utilities, making normal administrative recovery more difficult. Additional reported defensive features include process masquerading, string decryption at runtime, anti-debugging and anti-analysis checks, integrity verification, in-memory or fileless re-execution techniques, and termination of competing botnet processes. No specific threat actor attribution is established at high confidence. Overall, Tengu represents an evolution of Mirai-style IoT malware from primarily DDoS tooling into a more resilient Linux botnet platform with persistence, proxying, payload delivery, reconnaissance, and strong defense-evasion features.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Besides persistence through systemd and init.d... Tengu tries to use cron, the tool for scheduling recurring tasks, though Nozomi found this method doesn’t work as intended.
...добавляет init- и rc-скрипты, меняет стартовые файлы оболочки...
Besides persistence through systemd and init.d... Tengu tries to use cron, the tool for scheduling recurring tasks, though Nozomi found this method doesn’t work as intended.
Tengu, observed by Nozomi Networks Labs, spreads through Telnet credential brute-forcing
Также для закрепления в системе Tengu создает фиктивный systemd...
Besides persistence through systemd and init.d, two Linux systems that automatically launch services when a device starts up, Tengu tries to use cron...
Its unique persistence strategy involves a guardian process that monitors the main malware and relaunches it if stopped. Critically, it can also leverage the hardware watchdog timer; if the main process is killed, the watchdog is left unfed, causing a device reboot, which then allows Tengu's other persistence methods to reactivate.
...добавляет init- и rc-скрипты, меняет стартовые файлы оболочки...
Besides persistence through systemd and init.d... Tengu tries to use cron, the tool for scheduling recurring tasks, though Nozomi found this method doesn’t work as intended.
Tengu, observed by Nozomi Networks Labs, spreads through Telnet credential brute-forcing
Также для закрепления в системе Tengu создает фиктивный systemd...
Besides persistence through systemd and init.d, two Linux systems that automatically launch services when a device starts up, Tengu tries to use cron...
Its unique persistence strategy involves a guardian process that monitors the main malware and relaunches it if stopped. Critically, it can also leverage the hardware watchdog timer; if the main process is killed, the watchdog is left unfed, causing a device reboot, which then allows Tengu's other persistence methods to reactivate.
To reduce the chance of detection, Tengu decrypts its strings only during execution...
...один из компонентов Tengu создает отдельный фоновый процесс, который маскируется под системный поток [kworker/0:0]...
Tengu, observed by Nozomi Networks Labs, spreads through Telnet credential brute-forcing
...collection of system and network details... It also adds... system and network reconnaissance...
Эта малварь поддерживает 25 видов DDoS-атак, может развертывать SOCKS5-прокси, выполнять шелл-команды, собирать информацию о системе и сети...
Another process repeatedly scans running processes and terminates competing botnets.
Эта малварь поддерживает 25 видов DDoS-атак, может развертывать SOCKS5-прокси, выполнять шелл-команды, собирать информацию о системе и сети...
Registration, heartbeat traffic, and command output are sent in plaintext, while server commands and updates use a custom ChaCha20/Poly1305-like authenticated encryption scheme.
Также обнаружилось, что Tengu мог получать идентификаторы дополнительных файлов с управляющего сервера злоумышленников...
Если малварь обнаружили, и ее основной процесс принудительно завершили, [kworker/0:0] перестает подавать сигналы. В результате сторожевой таймер считает, что устройство зависло, и осуществляет жесткую перезагрузку... Одновременно с этим Tengu мешает администраторам штатно перезагрузить или выключить зараженное устройство.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tengu is a Mirai-based botnet malware that brute-forces Telnet credentials, supports 25 DDoS attack types, can deploy a SOCKS5 proxy, execute shell commands, collect system and network information, persist via fake systemd/init/rc scripts and immutable binaries, and download/run additional ELF or APK payloads. Its standout self-protection feature abuses the hardware/software watchdog timer so that killing the main malware process causes a forced reboot, after which persistence relaunches the malware. It also interferes with normal shutdown/reboot by corrupting ELF headers of system utilities.
Mirai-derived botnet targeting Linux devices that brute-forces Telnet credentials, supports multiple DDoS attack methods, provides SOCKS5 proxying, executes shell commands, collects data, updates itself, and downloads additional ELF or APK payloads. It uses a guardian process and hardware watchdog abuse for persistence and self-defense, including forcing device reboots when the main process is terminated.
A Mirai-derived IoT botnet targeting Linux-based devices. It spreads via Telnet credential brute-force attacks and includes encrypted command channels, SOCKS5 proxying, shell command execution, payload delivery, system and network reconnaissance, and 25 DDoS methods. It emphasizes persistence and self-defense through systemd/init.d persistence, a guardian process, Linux hardware watchdog abuse to force reboots after process termination, process masquerading, anti-debugging, anti-hooking, anti-emulation, and code integrity checks.
Mirai-derived botnet targeting compromised Linux/IoT devices. It uses Telnet credential brute force for initial access, supports 25 DDoS methods, can run a SOCKS5 proxy, execute shell commands, collect system and network data, self-update, and fetch additional ELF or APK payloads. It features multiple persistence and self-defense mechanisms, including guardian process relaunch, fake systemd/init/RC persistence, shell startup modification, immutable file marking, cron persistence, and abuse of the hardware watchdog to force reboot and regain execution if defenders terminate the main process.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.