Tengu: New Mirai-Variant Botnet Targeting Linux IoT and Android TV Devices via Telnet Brute-Force — Threadlinqs Intelligence
As of 2026-07-29, Tengu: New Mirai-Variant Botnet Targeting Linux IoT and Android TV Devices via Telnet Brute-Force is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1758 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Nozomi Networks Labs discovered Tengu, a modernized Mirai-derived botnet that compromises Linux-based IoT devices and Android TV boxes via Telnet credential brute-force, then installs an encrypted
Tengu is a newly catalogued Mirai-family botnet observed by Nozomi Networks Labs — flagged by an internal ML-based clustering system as not matching any known malware signature — after its dropper repeatedly hit the vendor's honeypots via classic Telnet credential brute-force against default/weak factory credentials on internet-exposed embedded Linux devices (routers, IP cameras, DVRs, and similar consumer IoT). After gaining a shell, the dropper fetches an architecture-specific ELF bot binary (samples recovered for i386, amd64, MIPS, ARM, PowerPC, and m68k) from the same host that operates as the botnet's C2 server, 64.89.163.8:9931. That server also runs an IPFS gateway on TCP/8080 used to distribute both ELF payloads and Android APKs, indicating the operators are extending the traditional Mirai targeting envelope to poorly secured Android TV boxes and similar Android-based embedded devices — the bot validates and side-loads APKs with `aapt dump badging` and launches them via `am start -n '%s/.MainActivity'`.
Operationally, the bot exposes a SOCKS5 proxy (with authentication), arbitrary shell command execution, system/network reconnaissance, and 25 distinct DDoS attack methods spanning volumetric floods (UDP, TCP SYN/ACK/PSH, ICMP), protocol-specific floods (HTTP, DNS, NTP, SNMP, SIP, SSH, SMTP, FTP), and gaming-protocol abuse (Source Engine/TSource query, Minecraft). C2 traffic uses a hybrid model — plaintext registration/heartbeat framing wrapped in an outer XOR (key byte 0x22) obfuscation layer, with command and update traffic protected by a ChaCha20/Poly1305-style AEAD scheme keyed from an embedded 256-bit key (`c2a1b84d9f73512e8a6c15f0b4d9e73b114a66895dc328927e34a5b148ce6103`) that Nozomi recovered from sample 097522a52986982b9eefc29f95efdd9d3b6032e7 (i386). The bot's self-update routine is triggered when a decrypted server message begins with the magic constant `0xDEAFBEEF`. The malware also embeds dormant, time-seeded DGA logic (using the current time plus a table of randomly selected TLDs embedded in the binary) for fallback C2 resolution that has not been observed active in the wild.
Tengu's standout engineering investment is anti-remediation and anti-forensics, not exploitation novelty. A detached guardian process (masquerading in the process table as a kernel worker thread, `[kworker/0:0]`) polls the main bot process roughly every 60 seconds and relaunches it if it stops. Persistence is installed redundantly via a real systemd unit, init.d/procd/rc.local/rc*.d modification, and a (partially broken) cron entry referencing `/proc/self/exe`, using decoy service names (`chud-daemon`, `chud-watchdog`, `chud-scheduler`). Most notably, the bot disables then re-arms the device's hardware watchdog (`/dev/watchdog0`) with a ~30-second timeout: if an incident responder kills the malware's process without disabling the watchdog, the device force-reboots before the watchdog is fed again, destroying the volatile memory state that would otherwise evidence the compromise, while the multiply-redundant persistence mechanisms simply relaunch the bot after boot. The malware additionally overwrites the device's reboot/shutdown utility binaries with corrupted ELF headers carrying an "ELFOOD" marker ("binary bricking"), further hindering clean remediation, and runs a competitor-killing loop (polling `/proc` every ~500ms, using netlink connector events and inotify) that SIGKILLs rival bot/miner processes to protect its foothold.
Anti-analysis tradecraft includes runtime string decryption via a custom XOR stream cipher keyed from two linear congruential generators, `memfd_create`-based fileless re-execution (falling back to `/dev/shm/.journal` when `memfd_create` is unavailable), argv[0] spoofing as `/usr/lib/systemd/systemd-journald`, `TracerPid` checks in `/proc/self/status` for debugger detection, inspection of `LD_PRELOAD`/`LD_LIBRARY_PATH` in `/proc/self/environ` for hooking tools, back-to-back `rdtsc` timing checks (self-terminat
Weaknesses (CWE)
CWE-1391, CWE-798, CWE-521
Target sectors: consumer, smallofficehomeoffice, telecoms, mediaandentertainment
Target regions: Global
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1078.001, T1110.001, T1059.004, T1106, T1543.002, T1037.004, T1053.003, T1546.004, T1036.005, T1036.004
