The most surprising thing about the new Mirai‑derived menace is that it can force a device to reboot when defenders kill its main process. That trick, built around the Linux hardware watchdog, gives the Tengu botnet a fresh way to stay alive on compromised machines.
Tengu botnet persistence tactics uncovered
Key Takeaways
- Watchdog abuse lets Tengu reboot devices after its process is terminated.
- It supports 25 DDoS methods and can run SOCKS5 proxies.
- Persistence includes fake systemd services, init scripts, immutable binaries, and a broken cron routine.
- Nozomi Networks observed the dropper reaching honeypots via Telnet brute‑force.
- Defenders should lock down Telnet, update firmware, and audit startup scripts.
That’s the catch. The watchdog isn’t a new vulnerability; it’s a standard Linux feature that ensures hardware stays responsive. Tengu’s authors simply turned it into a self‑defense tool. When the main malware process dies, the watchdog stops receiving keep‑alive pings, the timer expires, and the device reboots. On boot, the other persistence hooks get another shot at relaunching the malware.
How Tengu hijacks Linux watchdogs
According to Nozomi Networks Labs, the bot spawns a background worker that pretends to be [kworker/0:0]. That worker opens /dev/watchdog if it exists, arms it with an approximately 30‑second timeout, and feeds it keep‑alive signals only while the principal process runs. Kill that process and the watchdog goes silent, triggering a reboot.
That’s ironic. The very mechanism designed to protect embedded devices ends up giving attackers a reliable way to reset their foothold. The reboot isn’t silent either; Tengu carries a hardcoded list of shutdown utilities and overwrites their ELF headers with the string ELFOOD. That corruption can sabotage the normal commands defenders might use to safely power down a compromised box.
Watchdog timing and reboot logic
- Watchdog timeout: ~30 seconds
- Guardian check interval: 60 seconds
- Reboot triggers when keep‑alive stops
It didn’t work. In practice, the reboot gives the bot another chance to execute its persistence scripts, which are scattered across systemd, init, and cron pathways.
Persistence mechanisms beyond the watchdog
Beyond the watchdog trick, Tengu drops a detached guardian that monitors the main process every 60 seconds. If the process disappears, the guardian relaunches the installed binary. The malware also creates a fake systemd service, injects init and RC scripts, and tweaks shell startup files. It even marks its binary as immutable, making it harder for admins to delete.
And the cron routine? It references /proc/self/exe but appears unfinished or broken, according to Nozomi. That suggests the authors tried to add yet another persistence vector but left it half‑implemented.
Other persistence hooks
- Fake systemd unit file
- Init and RC scripts added
- Shell startup files altered
- Binary marked immutable
- Cron entry (unfinished)
That’s concerning. Each of those hooks can survive a simple reboot, meaning the botnet can maintain a foothold even if a device is power‑cycled.
Capabilities and payload flexibility
Tengu isn’t just about staying alive; it’s also a versatile attack platform. It supports 25 distributed denial‑of‑service (DDoS) methods, can run a SOCKS5 proxy, and executes arbitrary shell commands. It gathers system and network data, updates itself, and can fetch additional ELF or APK payloads.
It can pull content from an IPFS gateway hosted on the same C2 server, validate the result as an ELF or APK, and then execute or install it. Nozomi thinks the APK path likely targets poorly secured Android TV boxes, though they didn’t confirm any Android victims.
“Most Mirai variants implement few, if any, of these self‑defense capabilities,” the researchers said.
That’s remarkable. Most Mirai‑derived samples lack the layered persistence and watchdog abuse that Tengu shows.
Supported architectures
- i386
- amd64
- MIPS
- ARM
- PowerPC
- m68k
It didn’t need a specific vendor. Nozomi didn’t name a device model, operator, infection count, or real‑world DDoS victims. The report shows what Tengu can do, not how far it has spread.
Infrastructure clues and open questions
The analyzed sample was set to talk to a C2 server at 64.89.163.8 over TCP port 9931. Registration, heartbeat, and command output travel in plaintext, while server commands and updates use a custom ChaCha20/Poly1305‑like encryption scheme.
URLhaus logged 17 malware URLs at that IP beginning on June 17, 2026. Those URLs included a shell script, multiple ELF files tagged as Mirai, and an APK. The most recent payloads appeared on July 7, and all 17 URLs were offline by July 28.
That’s a clue. URLhaus didn’t label the files as Tengu, and none of the SHA‑256 hashes matched the sample Nozomi published. So the telemetry confirms malicious Mirai‑related hosting at the address, but it doesn’t prove the C2 was active for Tengu.
Neither Nozomi nor URLhaus could verify whether the C2 on port 9931 or the IPFS gateway on port 8080 was reachable. Nozomi also didn’t say whether the C2 actually issued commands. The Hacker News has reached out for more details and will update the story when it hears back.
Mitigation steps for IoT operators
Defenders should first stop exposing Telnet and other unnecessary admin services to the Internet. Changing default credentials is a must. Updating firmware, segmenting IoT networks, and reviewing systemd services, init scripts, shell startup files, and cron paths can cut many of Tengu’s persistence routes.
And you should consider making the watchdog device read‑only where possible. If the hardware watchdog can’t be opened by unprivileged processes, the reboot trick loses its edge.
Practical checklist
- Close Telnet ports on all production devices.
- Replace default passwords with strong, unique ones.
- Apply firmware updates promptly.
- Isolate IoT devices on separate VLANs.
- Audit systemd unit files for unknown services.
- Search for init/RC scripts that reference unknown binaries.
- Check shell startup files for unexpected entries.
- Inspect cron directories for orphaned jobs.
That’s actionable. If you lock down those vectors, you’ll strip Tengu of most of its persistence arsenal.
What This Means For You
If you manage fleets of Linux‑based IoT devices, you now have to treat the hardware watchdog as a potential attack surface. That means reviewing your device’s firmware for unnecessary watchdog exposure and ensuring that only trusted code can interact with /dev/watchdog. It also means tightening your monitoring for sudden reboots that could signal a watchdog‑triggered relapse.
Developers building embedded Linux images should consider disabling the watchdog by default or configuring it with a longer timeout that only privileged processes can reset. Adding immutable flags to critical binaries is a double‑edged sword; while it can protect against tampering, it also makes removal harder if the binary turns malicious.
That’s the takeaway. In the arms race over IoT security, attackers are now weaponizing a feature meant to keep devices alive, and defenders need to flip that script.
Will future botnets adopt similar watchdog tricks, or will manufacturers redesign hardware watchdogs to require authenticated keep‑alive signals? Only.
Historical Context
Since the first wave of Mirai‑style malware, most variants have relied on simple persistence: hard‑coded credentials, static startup scripts, and occasional reboot loops. Those early families rarely touched the kernel‑level watchdog because it was seen as a low‑risk component. Tengu changes that narrative by turning a safety feature into a weapon.
That shift matters. The watchdog has always been part of the Linux kernel, present on a broad range of embedded platforms. By co‑opting it, the authors gain a method that works across architectures without needing device‑specific tricks. The result is a persistence layer that survives even aggressive reboot strategies.
Older botnets often left a single point of failure—if the primary process was stopped, the infection vanished. Tengu’s guardian and watchdog combination creates redundancy. Two independent mechanisms can revive the malware, making removal substantially harder.
Security researchers have observed similar tactics in other contexts, where legitimate system components are repurposed for malicious ends. The pattern reinforces a growing lesson: trusted kernel features are not immune to abuse. Auditors now need to expand their scope beyond user‑space scripts and examine kernel interfaces that can be opened by non‑root processes.
Key Questions Remaining
- Will manufacturers start shipping devices with the watchdog disabled by default, or will they add authentication checks?
- Can defenders reliably detect the brief window when the watchdog is armed but not yet feeding keep‑alive signals?
- What impact will the immutable binary flag have on incident response workflows in large IoT deployments?
- Will future C2 infrastructure adopt encrypted channels that hide watchdog‑related traffic from network sensors?
Answers to these questions will shape the next generation of IoT hardening. Researchers are already probing the feasibility of kernel‑level alerts that fire when /dev/watchdog is opened by an unexpected user. If such alerts become standard, the advantage Tengu gains from the watchdog could diminish.
For now, the community must treat the watchdog as a potential entry point. Continuous monitoring, firmware hygiene, and strict access controls remain the most effective defenses.
Sources: The Hacker News, URLhaus
