Tengu Mirai Botnet Uses Watchdog Reboots and Binary Bricking to Resist Removal

Tengu, a newly observed Mirai-derived botnet, is demonstrating how modern IoT malware is rapidly evolving beyond traditional distributed denial-of-service (DDoS) operations by integrating persistence, evasion, and multi-functional attack capabilities.

Unlike legacy Mirai variants, Tengu employs a hybrid C2 model that blends plaintext and encrypted communications.

Initial registration and heartbeat messages are transmitted in cleartext, while command execution and updates are protected using an AEAD scheme resembling ChaCha20-Poly1305.

The malware dynamically decodes its C2 infrastructure using XOR obfuscation, revealing hardcoded endpoints such as 64.89.163.8:9931, while also embedding dormant domain generation algorithm (DGA) logic for potential fallback communication.

Initial infection is achieved via Telnet brute-force attacks, a tactic consistent with Mirai lineage.

The dropper is a lightweight shell script that retrieves architecture-specific binaries over HTTP from the same server acting as the C2 node.

Once executed, the malware establishes persistence through multiple mechanisms including systemd service creation and init.d scripts, while a partially implemented cron-based persistence suggests ongoing development.

Tengu significantly expands operational capabilities by enabling infected hosts to function as SOCKS5 proxies, exfiltrate system and network telemetry, and execute arbitrary commands.

It supports payload delivery via both direct HTTP downloads and IPFS-based retrieval, indicating a shift toward decentralized infrastructure abuse.

Notably, it can deploy ELF binaries or APK payloads, suggesting targeting of Android-based IoT devices such as smart TVs.

The botnet’s attack surface is broad, incorporating over 25 DDoS vectors including UDP floods, TCP-based attacks (SYN, ACK, PSH), ICMP floods, and protocol-specific attacks targeting HTTP, DNS, NTP, SNMP, SIP, SSH, FTP, SMTP, and gaming services like Minecraft and Source Engine servers.

This flexibility enables both volumetric disruption and targeted service degradation.

Nozomi Researchers said that, Botnet Identified through machine learning-based malware clustering, Tengu stands out due to its combination of encrypted command-and-control (C2) communications, proxy functionality, payload delivery mechanisms.

A defining characteristic of Tengu is its advanced self-defense and persistence model. The malware deploys a watchdog mechanism that manipulates the system’s hardware watchdog timer.

If the primary process is terminated, the watchdog triggers a forced reboot, allowing persistence mechanisms to relaunch the malware. This effectively turns a defensive system feature into an anti-remediation tool.

Tengu Mirai Botnet Uses Watchdog

Further complicating incident response, Tengu implements “binary bricking” by overwriting critical system binaries associated with reboot and shutdown operations using malformed ELF headers.

This can render standard recovery procedures ineffective, forcing defenders to rely on alternative remediation approaches such as firmware reinstallation.

Tengu also aggressively removes competing malware through a continuous process-killing loop. By monitoring process creation via /proc, inotify, and Linux process connectors, it identifies and terminates rival botnet processes using signature-based matching.

This ensures exclusive control over compromised devices, a common trend in increasingly competitive IoT botnet ecosystems.

Anti-analysis techniques further enhance its stealth. The malware uses XOR-based string encryption, fileless execution via memfd_create, process masquerading as systemd services, and multiple debugger detection techniques including TracerPid checks and execution timing analysis using rdtsc instructions.

It also disables core dumps and adjusts OOM killer preferences to avoid termination under resource pressure.

Security researchers were able to extract the embedded encryption key and emulate the botnet by redirecting samples to a controlled C2 environment, confirming the malware’s full command set and behavior.

These findings highlight a shift toward more resilient and modular IoT threats that combine traditional botnet activity with advanced evasion and persistence strategies.

The emergence of Tengu reinforces ongoing concerns around exposed IoT infrastructure. Devices with weak credentials, outdated firmware, and unnecessary internet exposure remain prime targets for botnet operators.

Organizations are advised to enforce strong authentication, disable Telnet access, segment IoT networks, and continuously monitor for anomalous outbound traffic or unauthorized services.

Platforms such as Nozomi Networks’ OT/IoT Security solution provide visibility into device behavior and network anomalies, enabling early detection of compromise and exploitation attempts.

As botnets like Tengu continue to evolve, proactive monitoring and hardened device configurations remain critical to reducing risk across increasingly complex IoT environments.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist