Tengu Botnet Modernizes Mirai with 25 DDoS Methods and Advanced Persistence on IoT and Embedded Linux

A new botnet called Tengu is actively infecting Internet of Things devices and embedded Linux systems to perform denial-of-service attacks, redirect traffic, and maintain long-term access on compromised hosts.

The threat is a modernized variant of the well-known Mirai malware. Infection typically begins with brute-force attempts against exposed Telnet services. After obtaining valid credentials, a downloader script retrieves the appropriate malware binary matching the device architecture.

Tengu uses partially encrypted communication channels with its command-and-control infrastructure. Operators can execute arbitrary commands, gather detailed system and network information, update the implant, and convert the device into a SOCKS5 proxy.

The botnet ships with 25 DDoS attack methods, including UDP, TCP, and ICMP floods. It can also target HTTP, DNS, NTP, SSH, SMTP, FTP, SIP services as well as Minecraft servers and hosts running the Source Engine and Quake protocols.

Persistence and Self-Protection Mechanisms

The primary distinguishing features of Tengu are its advanced persistence and defensive capabilities. A secondary monitoring process checks the main malware every 60 seconds and automatically restarts it if the process is terminated.

• Fake systemd services and modified init scripts ensure the malware reactivates after reboots.
• The botnet manipulates the device watchdog timer to trigger a reboot whenever its process is removed.
• It corrupts legitimate shutdown utilities and actively eliminates competing malware that attempts to take control of the same device.