Linux devices rebooted by Tengu botnet after takedown
A new Mirai-derived botnet is outsmarting defenders by using the hardware watchdog on Linux devices to reboot itself whenever its main process is killed. Named Tengu, this malware adds another layer of persistence by forcing a system restart if administrators attempt to shut it down, giving its other backdoors a fresh chance to reactivate.
Security researchers at Nozomi Networks Labs detected Tengu after observing its dropper infiltrating honeypots via Telnet brute-force attacks. Once inside, the botnet installs multiple persistence mechanisms and integrates a distributed denial-of-service capability, expanding its attack surface beyond simple credential theft.
A clever twist on persistence
Most Linux malware relies on cron jobs, systemd services, or cron.d entries to survive reboots. Tengu goes further by weaponizing the hardware watchdog—a feature originally designed to prevent system hangs. When defenders terminate the botnet’s main process, the watchdog interprets the lack of periodic “heartbeat” signals as a crash and triggers an immediate reboot. During startup, Tengu’s other persistence layers reload, effectively resurrecting the infection.
From brute force to DDoS arsenal
Tengu’s delivery method mirrors older IoT botnets, exploiting weak Telnet credentials to gain initial access. Once compromised, devices join a growing network capable of launching distributed denial-of-service attacks. The malware supports at least 25 DDoS techniques, including SYN floods and UDP amplification, raising the stakes for organizations running unpatched Linux systems in exposed environments.
Why it matters
Tengu demonstrates how attackers are refining persistence tactics to bypass even proactive cleanup efforts. For Linux administrators, this means traditional process termination no longer guarantees removal, and watchdog configurations must now be scrutinized alongside firewall rules and credential policies. The botnet’s blend of old and new techniques underscores the evolving threat landscape for IoT and embedded Linux devices, where a single weak password can turn a system into a reboot-resistant zombie in a larger DDoS army.
Source: The Hacker News. AI-assisted editorial synthesis — TechnoExpress.