Tengu Botnet Uses Hardware Watchdog to Reboot Compromised Linux Devices

Tengu Botnet's Resilience

Nozomi Networks Labs identified Tengu, a new botnet derived from Mirai, which employs a unique self-defense mechanism. When security defenders attempt to terminate its primary process on a compromised Linux device, Tengu can trigger a hardware watchdog to force a system reboot. This action provides an opportunity for the botnet's other persistence mechanisms to reactivate it.

Infection and Capabilities

The botnet gains initial access to devices through Telnet credential brute-forcing, as observed by Nozomi's honeypots. Once active, Tengu offers 25 different distributed denial-of-service (DDoS) methods. Beyond DDoS attacks, it can establish a SOCKS5 proxy, execute arbitrary shell commands, and gather system and network information. The malware is also capable of self-updating and retrieving additional Executable and Linkable Format (ELF) or Android Package (APK) payloads, supporting various architectures including i386, amd64, MIPS, ARM, PowerPC, and m68k.

Advanced Persistence Mechanisms

Tengu's persistence stands out from typical Mirai variants due to its sophisticated self-defense code. It creates a detached guardian process that monitors the main malware every 60 seconds, relaunching it if stopped. Other persistence methods include creating fake systemd services, adding init and RC scripts, modifying shell startup files, and marking its binary immutable. The hardware watchdog abuse involves a background worker that reopens the watchdog device, sets a 30-second timeout, and sends keepalive signals only while the main process is active. If the main process is killed, the watchdog is not fed, leading to a device reboot and allowing other persistence methods to reactivate Tengu.

Recommendations for Defenders

Nozomi Networks Labs, which published its analysis on July 27, 2026, advises defenders to secure their devices by removing internet exposure for Telnet and other non-essential administrative services, and by replacing default credentials. Additional recommendations include updating firmware, segmenting IoT networks, and thoroughly reviewing systemd services, init scripts, shell startup files, and cron-related paths before redeploying a potentially compromised device.