Killing the bot process may restart the infection instead of stopping it. Tengu feeds a hardware watchdog only while its main process is alive, so a defender that kills the process can trigger a reboot and give the malware’s other persistence hooks another chance to relaunch it.
Nozomi says Tengu is a Mirai-derived botnet that runs across i386, amd64, MIPS, ARM, PowerPC, and m68k systems. It can also plant multiple startup hooks, mark its binary immutable, and use those same restart paths after reboot, so cleanup has to account for more than the running process.
The result is a weaker containment assumption for Linux IoT and embedded systems with watchdogs. Standard kill-and-clean handling can backfire if the reboot restores the bot from another persistence layer.