Tengu Botnet Weaponizes Hardware Watchdog to Survive Removal Attempts
Nozomi Networks Labs uncovers a Mirai-derived malware strain that forces system reboots when defenders try to kill its process.
A newly discovered botnet called Tengu is turning a standard system reliability feature into a weapon against security teams. The Mirai-derived malware, identified by Nozomi Networks Labs, arms the hardware watchdog on compromised Linux devices so that killing its main process triggers an automatic system reboot.
A Self-Defense Mechanism Unlike Other Mirai Variants
Tengu deploys a background worker that masquerades as the legitimate kernel process 'kworker/0:0' to arm the hardware watchdog with approximately a 30-second timeout. If defenders terminate the main malware process, the watchdog expires and forces the device to reboot, allowing Tengu's persistence mechanisms to re-establish control.
"Most Mirai variants implement few, if any, of these self-defense capabilities," Nozomi Networks Labs researchers wrote.
The malware spreads via Telnet credential brute-force attacks and targets a wide range of processor architectures: i386, amd64, MIPS, ARM, PowerPC, and m68k. This broad compatibility suggests operators are casting a wide net across IoT and embedded devices.
Persistence Through Multiple Vectors
Tengu employs layered persistence mechanisms designed to survive removal attempts. A detached guardian process checks the main binary every 60 seconds and can restore it if tampered with. The malware also creates fake systemd services, installs init/RC scripts, and marks its binary as immutable to prevent deletion.
In a particularly aggressive move, Tengu overwrites the ELF headers of system reboot and shutdown utilities with the string 'ELFOOD', rendering these commands inoperable and further hampering defender efforts to regain control.
DDoS Capabilities and Command Infrastructure
Once established, Tengu provides operators with extensive offensive capabilities. The botnet supports 25 different DDoS attack methods, can operate a SOCKS5 proxy for traffic routing, execute arbitrary shell commands, and collect system and network reconnaissance data.
Researchers observed command-and-control communication at 64[.]89.163.8 over TCP port 9931. The malware uses plaintext for heartbeat signals but employs a custom ChaCha20/Poly1305-like encryption scheme for actual commands, balancing operational stealth with communication reliability.
Implications for IoT Security
Tengu represents a modernization of the Mirai botnet, which has plagued IoT devices since 2016 by exploiting default credentials. While many Mirai variants exist, Tengu distinguishes itself through advanced persistence and anti-analysis techniques specifically designed to make infections harder to remove from live systems.
The weaponization of hardware watchdog timers marks a sophisticated shift in IoT malware strategy. By forcing reboots upon detection, the botnet ensures its persistence hooks have repeated opportunities to re-infect the system, effectively turning a standard reliability feature into a tool for malware survival.
Security teams responding to Tengu infections must account for the watchdog mechanism before attempting removal, potentially requiring hardware-level intervention or bootloader modifications to fully eradicate the threat.