Full Report
A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force. Tengu supports 25 distributed denial-of-service (
Analysis Summary
# Tool/Technique: Tengu Botnet
## Overview
Tengu is a sophisticated Mirai-derived botnet primarily targeting Linux-based IoT devices and potentially Android systems. It distinguishes itself from typical Mirai variants through advanced self-defense mechanisms and persistent presence, most notably the abuse of hardware watchdog timers to force system reboots if the malware process is terminated.
## Technical Details
- **Type:** Malware family (Mirai variant)
- **Platform:** Linux (i386, amd64, MIPS, ARM, PowerPC, m68k), potentially Android (via APK payloads)
- **Capabilities:** DDoS (25 methods), SOCKS5 proxy, remote shell execution, system/network data collection, self-updating.
- **First Seen:** June 17, 2026 (Initial URLhaus observations); Reported by Nozomi Networks on July 27, 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1110.001 - Brute Force: Password Guessing] (Telnet)
- **[TA0003 - Persistence]**
- [T1543.002 - Create or Modify System Process: Systemd Service]
- [T1037.004 - Boot or Logon Initialization Scripts: RC Scripts]
- [T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification]
- [T1053.003 - Scheduled Task/Job: Cron]
- **[TA0005 - Defense Evasion]**
- [T1564.002 - Hide Artifacts: Web Shell] (Masquerading as `kworker/0:0`)
- [T1222.002 - File and Directory Permissions Modification: Linux Specific] (Making binaries immutable)
- [T1497 - Virtualization/Sandbox Evasion] (Hardware Watchdog abuse)
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols] (IPFS gateways)
- [T1573.002 - Encrypted Channel: Asymmetric Cryptography] (ChaCha20/Poly1305)
## Functionality
### Core Capabilities
- **DDoS Engine:** Supports 25 distinct distributed denial-of-service methods.
- **Botnet Command & Control:** Communicates via TCP/9931 for heartbeat and command output (plaintext) and encrypted server commands.
- **Reconnaissance:** Collects detailed system and network environment data.
- **Payload Delivery:** Can fetch and execute ELF or APK files via InterPlanetary File System (IPFS) gateways.
### Advanced Features
- **Hardware Watchdog Abuse:** Arms the device's watchdog timer and sends keep-alive signals only while the main process is healthy. If the process is killed, the watchdog triggers a hardware reboot, allowing persistence mechanisms to restart the bot.
- **Process Guarding:** Forks a detached "guardian" process that monitors and relaunches the main bot every 60 seconds if it is stopped.
- **Utility Sabotage:** Overwrites ELF headers of system commands (like `reboot` or `shutdown`) with the string "ELFOOD" to prevent defenders from cleanly restarting the device.
- **Immutable Persistence:** Marks its installed binaries as immutable to prevent deletion.
## Indicators of Compromise
- **File Hashes:** No specific SHA-256 provided in the summary (Nozomi noted their samples differed from those on URLhaus).
- **File Names:** Masquerades as `kworker/0:0`.
- **Registry Keys:** N/A (Linux/Android target).
- **Network Indicators:**
- `64[.]89.163.8` (C2 and IPFS Gateway)
- Port `9931` (C2 Traffic)
- Port `8080` (IPFS Content Delivery)
- **Behavioral Indicators:** Modification of `/etc/init.d`, RC scripts, systemd services, and shell startup files. ELF headers of reboot utilities containing the string `ELFOOD`.
## Associated Threat Actors
- **Unknown.** Currently identified as a modern Mirai variant with no specific group attribution.
## Detection Methods
- **Signature-based:** Scan for ELF files containing the string `ELFOOD`.
- **Behavioral:** Monitor for unauthorized modifications to system startup scripts and unexpected writes to `/dev/watchdog`.
- **Network:** Monitor for outbound traffic to known C2 IP addresses on non-standard ports (9931) and IPFS gateway communications.
## Mitigation Strategies
- **Attack Surface Reduction:** Disable Telnet and other unnecessary administrative services on internet-facing devices.
- **Credential Hygiene:** Replace default manufacturer credentials with strong, unique passwords.
- **System Hardening:** Segment IoT devices into isolated networks to prevent lateral movement.
- **Integrity Checks:** Before returning a suspected device to service, audit `systemd` services, `init` scripts, and `cron` paths.
## Related Tools/Techniques
- **Mirai:** The base source code from which Tengu is derived.
- **XLabsv1:** Another Mirai-based botnet targeting Android-based devices.
- **IPFS Persistence:** Use of decentralized web protocols for resilient malware distribution.