Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process — Threadlinqs Intelligence
As of 2026-07-28, Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1745 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Tengu is a Mirai-derived Linux/IoT botnet, documented by Nozomi Networks Labs, that compromises internet-exposed embedded devices across six CPU architectures via Telnet credential brute force. It
Tengu is a newly documented Mirai-lineage botnet targeting internet-facing embedded Linux systems — routers, cameras, DVRs, and other low-maintenance devices — that expose Telnet or similar remote administration services. Nozomi Networks Labs published the first technical analysis on 2026-07-27, and the finding was corroborated the following day by The Hacker News, Cyber Security News, Cyberpress, and Cryptika Cybersecurity.
Initial access is achieved through Telnet credential brute force against honeypot and internet-exposed devices. A shell-script dropper subsequently pulls an architecture-specific binary over HTTP, with samples confirmed for i386, amd64, MIPS, ARM, PowerPC, and m68k — giving Tengu one of the broadest hardware footprints observed in a current Mirai derivative.
What separates Tengu from generic Mirai clones is its anti-remediation depth. The primary malware process forks a detached guardian that checks the main process every 60 seconds and relaunches the installed binary if it is stopped. In parallel, a background worker masquerading as the kernel thread "[kworker/0:0]" reopens the hardware watchdog device where available, arms it with an approximately 30-second timeout, and issues keepalive signals only while the main malware process remains alive — meaning that if a defender kills the process without disabling the watchdog, the device is forced into a hardware reboot, destroying volatile forensic evidence and undoing in-memory remediation. Tengu additionally marks its installed binary immutable, installs fake systemd service units, alters init/RC scripts and shell startup files (cron-based persistence is present but described as unfinished/broken), and overwrites the ELF headers of a hardcoded list of reboot/shutdown utility binaries with the string "ELFOOD" — corrupting the very tools an administrator would use to cleanly power-cycle the device.
The malware also runs largely fileless: it uses memfd_create() to build an in-memory file named "systemd-journal" (falling back to /dev/shm/.journal if memfd is unavailable), deletes the filesystem-visible entry while keeping the file descriptor open, and re-executes itself via execve — leaving little on-disk footprint. The main process additionally rewrites its displayed command-line name to /usr/lib/systemd/systemd-journald to blend into normal process listings, and performs self-integrity checks by reading /proc memory-mapping information, computing a baseline SHA-256 value over part of its own code, and repeatedly comparing it (alongside monitoring for unexpectedly writable memory mappings) to detect tampering, patching, or analysis.
Command and control runs to 64.89.163.8 over TCP/9931. Registration, heartbeat, and command-output traffic are sent in plaintext, but server-issued commands and binary updates are protected with a custom ChaCha20/Poly1305-like authenticated encryption scheme. The C2 IP is XOR-obfuscated inside the binary, and dormant domain-generation-algorithm (DGA) logic is present but not observed in active use, suggesting a fallback capability the operator has not yet activated. The same host also serves an IPFS gateway (port 8080) used to retrieve additional ELF or APK payloads, including an Android APK whose delivery path suggests targeting of poorly secured Android TV boxes, though no confirmed Android infections have been documented.
Operational capabilities include 25 distinct DDoS methods, built-in SOCKS5 proxying (enabling proxy resale/relay abuse), arbitrary remote shell command execution, system and network reconnaissance data collection, self-updating, and the ability to detect and remove competing malware from a compromised device — a common Mirai-family trait aimed at monopolizing device resources.
URLhaus has tracked 17 malware URLs at 64.89.163.8 since 2026-06-17 (most recently 2026-07-07), comprising shell-script droppers, multiple ELF binaries tagged as Mirai, and one APK — corroborating that the C2 host doubles as an acti
Weaknesses (CWE)
CWE-521, CWE-306
Target sectors: iotconsumerdevices, smallofficehomeoffice, embeddedsystems, generalenterpriseiot
Target regions: Global
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1110, T1110, T1133, T1059, T1543, T1037, T1546, T1053, T1222, T1036
