Tengu Mirai Variant Uses Encrypted C2 and Anti-Tamper Reboots on IoT Devices

Researchers reported that Tengu, a modernized Mirai-derived malware family, is compromising internet-facing IoT and embedded Linux devices through Telnet brute force and deploying architecture-specific binaries via a shell-script dropper. The malware communicates with command-and-control infrastructure including 64[.]89.163.8:9931, uses plaintext registration and heartbeat traffic, and encrypts server-to-bot commands and updates with a ChaCha20/Poly1305-like AEAD scheme. Beyond traditional botnet activity, Tengu supports 25 attack methods covering volumetric and protocol-specific floods against services such as HTTP, DNS, NTP, SNMP, SIP, SSH, SMTP, FTP, game servers, and Minecraft, while also enabling proxying, payload delivery, and reconnaissance.

Tengu was also found to resist removal through layered persistence and self-defense features that make infected devices difficult to clean. Researchers said it abuses watchdog behavior, installs fake systemd and init-based persistence, respawns processes, kills competing malware, re-executes filelessly, masquerades as legitimate processes, and corrupts reboot or shutdown binaries with the string ELFOOD. It further monitors its own integrity by reading Linux /proc memory-mapping data, calculating a SHA-256 baseline over part of its code, and rebooting the device if defenders try to terminate or modify it, complicating incident response and making simple reboot-based remediation unreliable.