Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
Tengu is a new Mirai-derived botnet that uses hardware watchdogs to reboot compromised Linux devices when its main process is killed, enabling persistence through other mechanisms. It supports 25 DDoS methods, runs a SOCKS5 proxy, executes shell commands, collects system data, and updates itself with ELF or APK payloads. The malware employs multiple persistence techniques including fake systemd services, init scripts, shell startup modifications, and immutable binary flags. Communication with C2
Analysis
TL;DR
- Tengu is a new Mirai-derived botnet that uses hardware watchdogs to reboot compromised Linux devices when its main process is killed, enabling persistence through other mechanisms.
- It supports 25 DDoS methods, runs a SOCKS5 proxy, executes shell commands, collects system data, and updates itself with ELF or APK payloads.
- The malware employs multiple persistence techniques including fake systemd services, init scripts, shell startup modifications, and immutable binary flags.
- Communication with C2 servers uses plaintext for registration/heartbeat but custom ChaCha20/Poly1305-like encryption for commands and updates.
- Nozomi Networks Labs observed the botnet via Telnet credential brute force targeting honeypots, with no confirmed real-world victims or operator identified yet.
Why It Matters
This represents an evolution in IoT botnet sophistication by combining traditional Mirai-style exploitation with advanced self-defense mechanisms that actively thwart removal attempts. For security practitioners, it highlights the need for deeper inspection of device persistence layers beyond simple process termination and underscores the importance of securing administrative interfaces like Telnet against credential stuffing attacks. The use of hardware-level watchdog abuse demonstrates how attackers are leveraging low-level system features to create resilient malware that survives defensive actions.
Technical Details
- Watchdog-based persistence: A background worker masquerading as [kworker/0:0] arms the hardware watchdog with ~30-second timeout and sends keepalive signals only while the main malware process runs; killing the process stops signal transmission triggering automatic reboot.
- Guardian process: Forks a detached child process checking the main malware every 60 seconds and relaunching the binary if terminated.
- System manipulation: Creates fake systemd services, modifies init/RC scripts, alters shell startup files, marks installed binaries immutable, and includes broken cron-based persistence referencing /proc/self/exe.
- Defense disruption: Overwrites ELF headers of reboot/shutdown utilities with "ELFOOD" string to interfere with normal system administration commands.
- C2 communication: Uses TCP port 9931 for command/control with plaintext registration/heartbeat but custom authenticated encryption (ChaCha20/Poly1305 variant) for sensitive operations; also fetches payloads from IPFS gateways on same server.
- Multi-architecture support: Samples compiled for i386, amd64, MIPS, ARM, PowerPC, and m68k indicating broad IoT device targeting capability.
- Payload flexibility: Can retrieve and execute additional ELF binaries or Android APK packages from C2-controlled sources.
Industry Insight
Security teams should prioritize hardening IoT devices by disabling unnecessary remote access protocols (especially Telnet), enforcing strong unique credentials, implementing network segmentation to contain potential outbreaks, and establishing regular firmware update schedules. Monitoring systems should detect abnormal watchdog activity and unexpected process restart patterns as indicators of sophisticated botnet presence. Organizations must develop incident response procedures specifically designed to handle malware with self-recovery capabilities, recognizing that standard containment measures may be insufficient against such persistent threats. The emergence of hybrid attack vectors combining traditional exploitation with novel persistence techniques suggests continued evolution of IoT botnets requiring proactive threat intelligence sharing across security communities.
Disclaimer: The above content is generated by AI and is for reference only.