Tengu is a Mirai-derived botnet that uses multiple persistence tricks, including a hardware watchdog reboot loop, to survive process termination on compromised Linux devices. Nozomi Networks Labs found it supports many DDoS methods, proxying, command execution, and payload retrieval, with samples tied to C2 infrastructure at 64[.]89.163.8 and telemetry also showing Mirai-related hosting on the same address. #Tengu #Mirai #NozomiNetworksLabs #64.89.163.8
Keypoints
- Tengu is a new Mirai-derived botnet with strong persistence and self-defense features.
- It can reboot infected Linux devices by abusing the hardware watchdog.
- It supports 25 DDoS methods, SOCKS5 proxying, shell commands, and data collection.
- The malware can update itself and fetch ELF or APK payloads from C2.
- Defenders should disable Telnet exposure, replace default credentials, and harden IoT systems.
Read More: https://thehackernews.com/2026/07/tengu-botnet-reboots-compromised-linux.html