New Linux Bot Hides as Kernel Process and Launches DDoS Attacks

Cybersecuritynews •Tushar Subhra Dutta • September 7, 2026

A new Linux bot called Tengu is built to stay hidden and turn compromised systems into tools for disruption. The 32-bit malware poses as a routine kernel worker, persists across several Linux setups, and can generate traffic floods against selected targets. Its broad feature set puts servers, embedded systems, and IoT-adjacent devices at risk. Unlike […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Tengu Mirai: New Linux Botnet Threat Emerges A new Linux malware named Tengu has been identified, combining Mirai-style botnet techniques with advanced persistence and DDoS capabilities. This 32-bit ELF malware disguises itself as a Linux kernel worker process and targets servers, embedded devices, and IoT systems. Tengu's features include SSH probing and proxy capabilities, making it a versatile threat. The malware is designed to remain hidden and can generate significant traffic floods against selected targets. Its stealthy nature and broad attack vector increase the risk for various Linux environments. Currently, there are no specific CVEs or patches mentioned for this malware, indicating a potential gap in defenses. Security professionals are advised to monitor their systems for unusual activity related to this threat. 2 sources 49

Extracted Entities

New Linux Bot Hides as Kernel Process and Launches DDoS Attacks

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (1)