Loading malware…
Tengu is a Mirai-derived botnet malware family targeting Linux-based IoT and embedded devices. It spreads through Telnet credential brute-forcing and extends the traditional Mirai model with a broader post-compromise feature set that includes distributed denial-of-service attacks, SOCKS5 proxying, shell command execution, collection of system and network information, self-updating, and retrieval of additional payloads, including ELF binaries and Android APK packages. Samples have been observed across multiple CPU architectures commonly used in embedded environments.
A defining characteristic of Tengu is its unusually strong persistence and self-defense design for an IoT botnet. It maintains execution through multiple Linux persistence mechanisms, including fake service artifacts, init and rc scripts, shell startup modifications, and watchdog-style relaunch logic. It also marks its installed binary immutable to hinder removal. Its most distinctive mechanism abuses the device watchdog so that termination of the main malware process can cause the device to reboot, after which persistence mechanisms relaunch the malware. Tengu also interferes with normal shutdown and reboot workflows by corrupting system utilities responsible for those actions, making remediation more difficult.
Tengu has also been reported to use process masquerading and anti-analysis measures, including runtime string decryption, debugger and tampering checks, integrity verification, and in some analyses the ability to operate filelessly or kill competing botnets. The family is notable as an evolution of Mirai-style malware from simple DDoS tooling into a more resilient multi-purpose botnet platform suited for maintaining access on poorly secured internet-facing devices. No specific threat actor attribution is currently available, and reporting has not confirmed Android infections, although APK support suggests possible interest in Android-based IoT devices such as TV boxes.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Besides persistence through systemd and init.d... Tengu tries to use cron, the tool for scheduling recurring tasks, though Nozomi found this method doesn’t work as intended.
...добавляет init- и rc-скрипты, меняет стартовые файлы оболочки...
Besides persistence through systemd and init.d... Tengu tries to use cron, the tool for scheduling recurring tasks, though Nozomi found this method doesn’t work as intended.
Tengu, observed by Nozomi Networks Labs, spreads through Telnet credential brute-forcing
Также для закрепления в системе Tengu создает фиктивный systemd...
Besides persistence through systemd and init.d, two Linux systems that automatically launch services when a device starts up, Tengu tries to use cron...
Its unique persistence strategy involves a guardian process that monitors the main malware and relaunches it if stopped. Critically, it can also leverage the hardware watchdog timer; if the main process is killed, the watchdog is left unfed, causing a device reboot, which then allows Tengu's other persistence methods to reactivate.
...добавляет init- и rc-скрипты, меняет стартовые файлы оболочки...
Besides persistence through systemd and init.d... Tengu tries to use cron, the tool for scheduling recurring tasks, though Nozomi found this method doesn’t work as intended.
Tengu, observed by Nozomi Networks Labs, spreads through Telnet credential brute-forcing
Также для закрепления в системе Tengu создает фиктивный systemd...
Besides persistence through systemd and init.d, two Linux systems that automatically launch services when a device starts up, Tengu tries to use cron...
Its unique persistence strategy involves a guardian process that monitors the main malware and relaunches it if stopped. Critically, it can also leverage the hardware watchdog timer; if the main process is killed, the watchdog is left unfed, causing a device reboot, which then allows Tengu's other persistence methods to reactivate.
To reduce the chance of detection, Tengu decrypts its strings only during execution...
...один из компонентов Tengu создает отдельный фоновый процесс, который маскируется под системный поток [kworker/0:0]...
Tengu, observed by Nozomi Networks Labs, spreads through Telnet credential brute-forcing
...collection of system and network details... It also adds... system and network reconnaissance...
Эта малварь поддерживает 25 видов DDoS-атак, может развертывать SOCKS5-прокси, выполнять шелл-команды, собирать информацию о системе и сети...
Another process repeatedly scans running processes and terminates competing botnets.
Эта малварь поддерживает 25 видов DDoS-атак, может развертывать SOCKS5-прокси, выполнять шелл-команды, собирать информацию о системе и сети...
Registration, heartbeat traffic, and command output are sent in plaintext, while server commands and updates use a custom ChaCha20/Poly1305-like authenticated encryption scheme.
Также обнаружилось, что Tengu мог получать идентификаторы дополнительных файлов с управляющего сервера злоумышленников...
Если малварь обнаружили, и ее основной процесс принудительно завершили, [kworker/0:0] перестает подавать сигналы. В результате сторожевой таймер считает, что устройство зависло, и осуществляет жесткую перезагрузку... Одновременно с этим Tengu мешает администраторам штатно перезагрузить или выключить зараженное устройство.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mirai-based IoT malware that uses Telnet brute-force to compromise IoT devices and supports DoS attacks, persistence, command execution, payload download, metadata theft, and proxying.
Mirai-derived IoT malware that brute-forces Telnet to compromise devices for DoS attacks, persistence, exfiltration, command execution, payload download, and proxying.
A ransomware brand that recorded no industrial victim claims in Q2 2026 after prior activity.
Tengu is a Mirai-based botnet malware that brute-forces Telnet credentials, supports 25 DDoS attack types, can deploy a SOCKS5 proxy, execute shell commands, collect system and network information, persist via fake systemd/init/rc scripts and immutable binaries, and download/run additional ELF or APK payloads. Its standout self-protection feature abuses the hardware/software watchdog timer so that killing the main malware process causes a forced reboot, after which persistence relaunches the malware. It also interferes with normal shutdown/reboot by corrupting ELF headers of system utilities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.