Tengu Botnet Uses Hardware Watchdog to Reboot Linux Devices After Process Termination
Summary
Nozomi’s analysis describes Mirai-derived Tengu’s watchdog-triggered reboot and other persistence methods, Telnet brute-force delivery, and DDoS and payload capabilities. The article establishes no infection scale or real-world victims.
Key points
- Nozomi observed Tengu’s dropper reaching honeypots through Telnet credential brute force; the analysis identifies no specific device models or infection scale.
- A detached guardian checks the main malware process every 60 seconds and can relaunch its binary; other persistence methods include fake systemd services, init scripts, and shell startup files.
- A watchdog worker stops sending keepalives when the main process is terminated, allowing the device to reboot and Tengu’s other persistence mechanisms to try to relaunch it.
- Tengu supports 25 DDoS methods, SOCKS5 proxying, shell commands, system and network data collection, and retrieval of ELF or APK payloads.
- The analyzed sample was configured to use a C2 server at 64[.]89.163.8 over TCP port 9931; registration, heartbeat traffic, and command output are plaintext, while commands and updates use a custom encryption scheme.
- URLhaus recorded 17 malware URLs at the same IP, but did not identify them as Tengu; its listed hashes did not match Nozomi’s sample, so the telemetry supports only malicious Mirai-related hosting there.
- Nozomi recommends removing unnecessary internet-facing services such as Telnet, replacing default credentials, updating firmware, segmenting IoT networks, and checking persistence locations.
Article Details
- Attack Vectors
- The dropper reached Nozomi honeypots through Telnet credential brute force.
- Tengu uses a device hardware watchdog to trigger a reboot if its main process is terminated, allowing other persistence mechanisms to relaunch it.
- Tengu retrieves additional ELF or APK payloads through its C2 infrastructure, including an IPFS gateway on the same server.
- Defensive Notes
- Remove internet exposure for Telnet and other unnecessary administrative services, and replace default credentials.
- Update firmware and segment IoT networks.
- Before returning a suspected device to service, review systemd services, init scripts, shell startup files, and cron-related paths.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 64[.]89[.]163[.]8 | Configured Tengu C2 address; URLhaus separately recorded Mirai-related malware hosting at this address, but did not identify those files as Tengu. |
MITRE ATT&CK
T1037.004 · RC ScriptsTengu can add init and RC scripts for persistence.T1053.003 · CronThe analysis reports a cron-based persistence routine, while noting its /proc/self/exe reference appears unfinished or broken.T1059.004 · Unix ShellTengu can execute shell commands.T1090 · ProxyTengu supports SOCKS5 proxying.T1105 · Ingress Tool TransferTengu retrieves additional ELF or APK payloads from its C2 infrastructure.T1110.001 · Password GuessingThe dropper reached Nozomi honeypots through Telnet credential brute force.T1498 · Network Denial of ServiceThe article reports that Tengu supports 25 DDoS methods.T1529 · System Shutdown/RebootIf Tengu's main process is killed, its watchdog can stop receiving keepalives and cause the device to reboot.T1543.002 · Systemd ServiceTengu can create a fake systemd service for persistence.T1546.004 · Unix Shell Configuration ModificationTengu can modify shell startup files as a persistence mechanism.T1573 · Encrypted ChannelTengu's server commands and updates use a custom ChaCha20/Poly1305-like authenticated encryption scheme.
Malware
MiraiTengu is a Mirai-derived botnet that uses multiple persistence tricks, including a hardware watchdog reboot loop, to survive process termination on compromised Linux devices.TenguTengu is a Mirai-derived botnet that uses multiple persistence tricks, including a hardware watchdog reboot loop, to survive process termination on compromised Linux devices.
Products
AndroidThe malware can update itself and retrieve additional Executable and Linkable Format (ELF) or Android package (APK) payloads.LinuxTengu is a Mirai-derived botnet that uses multiple persistence tricks, including a hardware watchdog reboot loop, to survive process termination on compromised Linux devices.