Tengu: a Mirai botnet that hijacks the hardware watchdog to resurrect on every reboot

Nozomi Networks Labs documents Tengu, a multi-architecture Linux botnet that abuses the kernel watchdog and rewrites reboot binaries to survive cleanup attempts - all controlled via ChaCha20/Poly1305.

The facts

Nozomi Networks Labs published on July 27, 2026 the analysis of a new Linux botnet named Tengu, derived from the Mirai family. The malware targets seven compiled architectures: i386, amd64, MIPS, ARM, PowerPC, m68k, and an APK payload for Android TV boxes - in other words, the entire IoT/SOHO ecosystem plus a good part of exposed Linux servers.

Initial access remains classic: brute force Telnet on default credentials. What changes is what comes after.

The analysis - four nested layers of persistence

Nozomi describes four persistence mechanisms stacked, one particularly unusual:

1. Guardian process - a watchdog process that checks the main binary every 60 seconds and restarts it if it falls.
2. Fake systemd service, hijacked init/RC scripts, modifications to shell startup files (.bashrc, .profile).
3. Abuse of the hardware watchdog - this is the original part. A worker disguises itself as [kworker/0:0], opens the watchdog device (/dev/watchdog), arms it with a timeout of ~30 seconds, and only sends keepalives as long as the main process of the malware is running. Translation: if a defender kill -9 the binary, the hardware watchdog is no longer refreshed → the machine reboots itself after 30 seconds, and Tengu restarts with it.
4. Sabotage of reboot/shutdown binaries - the ELF headers of reboot and shutdown are overwritten by the string ELFOOD, preventing a clean shutdown for investigation.

The C2 runs on TCP/9931 to 64.89.163.8, with authenticated encryption of the ChaCha20/Poly1305 home type (the registration/heartbeat protocol remains, however, in plain text - an interesting attack angle for defenders). Announced capabilities: 25 DDoS methods, SOCKS5 proxy, remote shell execution, system/network collection, auto-update, and payload retrieval via IPFS gateway.

What this changes

The Linux kernel watchdog is a legitimate brick: it restarts a stuck machine. The attacker turns this feature into anti-forensics: any active intervention becomes a reboot trigger, which disrupts memory capture, cuts SSH sessions, and erases tmpfs. This is a pattern rarely found in classic Mirai-likes and that we will probably see spread.

The C2 in plaintext for registration leaves an exploitable network signature (regex on the first TCP/9931 exchanges), even if the operational channel is encrypted.

What to do now

Encadré - to do now

• Close Telnet (port 23) on the internet, no exceptions.
• Replace all default credentials, including on IP cameras, DVRs, SOHO routers, and Android TV boxes.
• Audit systemd services, init scripts, cron, .bashrc/.profile - Tengu hides everywhere.
• Detect [kworker/*] processes that open /dev/watchdog without legitimate rights (it's an anti-pattern).
• Segment IoT VLANs from the rest of the SI.
• Block outgoing to 64.89.163.8:9931 pending Nozomi's complete IOCs.

If a machine reboots itself during an investigation, it's no longer a bug to ignore - it's an IOC.