Loading story…
Researchers reported that Tengu, a modernized Mirai-derived malware family, is compromising internet-facing IoT and embedded Linux devices through Telnet brute force and deploying architecture-specific binaries via a shell-script dropper. The malware communicates with command-and-control infrastructure including 64[.]89.163.8:9931, uses plaintext registration and heartbeat traffic, and encrypts server-to-bot commands and updates with a ChaCha20/Poly1305-like AEAD scheme. Beyond traditional botnet activity, Tengu supports 25 attack methods covering volumetric and protocol-specific floods against services such as HTTP, DNS, NTP, SNMP, SIP, SSH, SMTP, FTP, game servers, and Minecraft, while also enabling proxying, payload delivery, and reconnaissance.
Tengu was also found to resist removal through layered persistence and self-defense features that make infected devices difficult to clean. Researchers said it abuses watchdog behavior, installs fake systemd and init-based persistence, respawns processes, kills competing malware, re-executes filelessly, masquerades as legitimate processes, and corrupts reboot or shutdown binaries with the string ELFOOD. It further monitors its own integrity by reading Linux /proc memory-mapping data, calculating a SHA-256 baseline over part of its code, and rebooting the device if defenders try to terminate or modify it, complicating incident response and making simple reboot-based remediation unreliable.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Nozomi Networks Labs published indicators of compromise for the Tengu botnet, including its command-and-control address and sample hashes for six processor architectures. The disclosure accompanied defender guidance to patch devices, replace default credentials, segment networks, and monitor IoT and Linux systems.
Researchers revealed that Tengu uses watchdog abuse, fake systemd and init persistence, process respawning, competitor killing, fileless re-execution, process masquerading, and anti-debugging to remain on infected devices. They also reported integrity checks and reboot-triggering behavior when defenders attempt to terminate or modify the malware, making remediation more difficult.
Researchers documented Tengu as a newly observed Mirai-derived malware family targeting internet-facing IoT and embedded Linux devices, commonly delivered via Telnet brute force and a shell-script dropper. The analysis described capabilities beyond DDoS, including encrypted command-and-control, payload delivery, reconnaissance, persistence, and self-defense.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcenozominetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported on **TuxBot v3 Evolution**, a previously undocumented modular IoT botnet framework that can infect devices, maintain persistence, communicate over encrypted command-and-control channels, and launch distributed denial-of-service attacks across **17 CPU architectures**. Researchers recovered the botnet’s source code, compiled binaries, Docker-based test infrastructure, and **254 DDoS benchmark reports**, showing active development and testing into early 2026. The malware’s working capabilities include Telnet brute-forcing with **1,496 credentials**, SSH, HTTP, and ADB scanning, plus fallback mechanisms such as a domain generation algorithm and peer-to-peer gossiping. The report said the framework appears to have been developed with heavy **LLM assistance**, which introduced several implementation flaws, including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake `Argon2id` routine that actually behaves like repeated SHA-256 hashing similar to PBKDF2. Despite those defects, Unit 42 assessed the botnet as operationally dangerous because its core infection and DDoS functions work, and the bugs are relatively easy to correct. Telemetry linked the malware to active infrastructure including a command-and-control server at `209.182.237[.]133` and a dropper at `185.10.68[.]127`, with reported ties to the **Keksec/Kaitori** and **AISURU** ecosystems.
Jul 21, 2026
Fortinet and other reporting identified **Nexcorium**, a Mirai-derived malware strain targeting Internet of Things devices, particularly **TBK DVR-4104** and **DVR-4216** video recorder systems used with security cameras. The campaign exploits **`CVE-2024-3721`**, an OS command injection flaw, to run a downloader script that retrieves malware binaries for multiple Linux architectures. Fortinet linked the activity to a suspected actor it calls **Nexus Team**, citing the custom HTTP header `X-Hacked-By: Nexus Team – Exploited By Erratic.` Once installed, Nexcorium uses classic Mirai-style scanner, watchdog, and attack modules, establishes persistence through mechanisms including init, `rc.local`, systemd, and cron, and spreads further through brute-force Telnet activity, default-password abuse, and exploitation of **`CVE-2017-17215`** in Huawei HG532 devices. The malware performs self-checks, replication, and self-deletion to improve resilience and evasion, then connects to the command-and-control domain `r3brqw3d[.]b0ats[.]top` to receive instructions for **DDoS** operations, including UDP, TCP SYN, TCP ACK, SMTP, and VSE query floods.
Jun 29, 2026
SophosLabs reported a Linux botnet dubbed **Chalubo** that compromises Internet-facing SSH servers through brute-force credential attacks and can also run on IoT hardware across multiple CPU architectures. The malware uses a layered infection chain in which a downloader establishes persistence, disguises its process name, retrieves an encrypted and LZMA-compressed payload, and launches the main bot; later campaigns also used the **Elknot** dropper. Researchers said Chalubo encrypts both its core bot and Lua-based command scripts with the **ChaCha** stream cipher and includes anti-analysis features more commonly associated with Windows malware. The botnet was built to conduct distributed denial-of-service activity, with Lua scripts enabling **DNS**, **UDP**, and **SYN flood** attacks. Sophos observed one command directing infected systems to launch a SYN flood against IP address `59.56.76.41` on port `10100`, while excluding several hardcoded addresses from targeting. Although the malware shares some code with **Xor.DDoS** and **Mirai**, researchers assessed it as a distinct family and urged defenders to harden SSH access, replace default credentials, and monitor suspicious outbound traffic to TCP port `8852`.
Jun 29, 2026