Malware · 47 days ago
Killing the bot process may restart the infection instead of stopping it. Tengu feeds a hardware watchdog only while its main process is alive, so a defender that kills the process can trigger a reboot and give the malware’s other persistence hooks another chance to relaunch it.
Nozomi says Tengu is a Mirai-derived botnet that runs across i386, amd64, MIPS, ARM, PowerPC, and m68k systems. It can also plant multiple startup hooks, mark its binary immutable, and use those same restart paths after reboot, so cleanup has to account for more than the running process.
The result is a weaker containment assumption for Linux IoT and embedded systems with watchdogs. Standard kill-and-clean handling can backfire if the reboot restores the bot from another persistence layer.
2 sources covering this story
Tengu botnet reboots Linux devices to survive removal - Help Net Security
Tengu, a Mirai-derived botnet, reboots infected Linux devices to survive removal and adds proxy, DDoS and stealth features.
Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
Tengu abuses Linux hardware watchdogs to reboot devices after its main process is killed, letting other persistence mechanisms relaunch it.
Part of the PlainSec briefing for 2026-07-29