This Linux Botnet Tricks Defenders by Rebooting Devices When They Kill It

Emily Davis · 2026-07-28

A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force. Tengu supports 25 distributed denial-of-service (DDoS) attack methods. ### How Tengu Exploits Hardware Watchdog The hardware watchdog is a timer that automatically reboots a device if the system stops responding. Tengu uses this feature to its advantage. When security tools kill its main process, the botnet triggers the watchdog, forcing a reboot. This gives Tengu's other persistence methods a fresh opportunity to reinstall the malware. It's a clever way to stay alive even after initial removal attempts. ### The Role of Telnet Brute Force Tengu spreads by brute-forcing Telnet credentials on exposed Linux devices. Many IoT devices and servers still use default or weak passwords. Nozomi's honeypots showed that the botnet targets these vulnerabilities to gain initial access. Once inside, it downloads the main payload and establishes persistence. ### Persistence Mechanisms That Keep Tengu Running Tengu doesn't rely on just one trick to stay active. It uses multiple methods: - Cron jobs that re-run the malware at set intervals - Systemd services that restart the process automatically - The hardware watchdog reboot trick to reset the device - Hidden files in common directories to avoid detection These layers make Tengu harder to remove than simpler botnets. ### What This Means for Security Teams Security professionals dealing with Linux botnets need to be aware of Tengu's tactics. Simply killing the process isn't enough. You need to: - Disable hardware watchdog timers if they're not needed - Remove all persistence mechanisms manually - Change Telnet credentials and switch to SSH with key-based authentication - Use network monitoring to spot unusual reboot patterns ### The Bigger Picture: Mirai Evolves Tengu is just the latest variation of the Mirai botnet code that's been around for years. Each new version finds smarter ways to evade detection and stay persistent. This evolution shows that defenders must constantly update their strategies. The hardware watchdog trick is a reminder that even basic hardware features can be weaponized. ### Protecting Your Linux Devices To defend against Tengu and similar botnets: - Disable Telnet access entirely - Use strong, unique passwords for all devices - Keep firmware and software updated - Monitor for unexpected reboots - Use intrusion detection systems that can spot brute force attempts Staying ahead of these threats requires vigilance and a multi-layered approach to security. > "Tengu's use of hardware watchdog is a wake-up call for Linux administrators. It's not enough to just kill malicious processes anymore." – Emily Davis, Head of Digital Privacy and Antidetect Browser Solutions at Antidetectbrowsershub By understanding how Tengu works, you can better protect your systems from this evolving threat.