A newly discovered botnet called Tengu exploits Linux hardware watchdogs to persist on compromised devices even when security teams terminate its main process. Tengu, derived from the Mirai codebase, triggers automatic system reboots through the watchdog mechanism when defenders kill its running instance. This reboot gives the botnet's secondary persistence mechanisms time to reinitialize Tengu before the system fully boots.
Nozomi Networks Labs first identified Tengu reaching their honeypots via Telnet brute-force attacks targeting weak credentials. Once installed, Tengu deploys multiple persistence layers including cron jobs, init scripts, and the watchdog trigger. The layered approach means killing the primary process alone does not remove the threat. Attackers must disable all persistence mechanisms simultaneously, a complexity that favors the attacker.
The botnet supports at least 25 different distributed denial-of-service attack vectors, making it effective for conducting large-scale network attacks. Tengu's inheritance from Mirai means it shares similar command-and-control architecture and scanning capabilities that have defined IoT botnets for years.
The watchdog reboot technique represents an escalation in botnet sophistication. Most IoT malware relies on simple persistence methods. Tengu's abuse of hardware watchdog functionality, typically designed to recover systems from crashes, transforms a legitimate safety mechanism into an evasion tool. This forces defenders to not merely kill processes but to identify and disable all persistence methods before the system reboots.
Organisations running internet-facing Linux devices face elevated risk, particularly systems with unpatched vulnerabilities or default credentials. The initial vector remains Telnet brute force, making credential hygiene and port filtering essential defensive measures. Disabling unnecessary services like Telnet and implementing network segmentation reduce exposure significantly.
Detection requires monitoring for abnormal process restarts,