New Tengu Mirai Botnet Reboots Your IoT Device When You Try to Kill It

Cybersecuritynews •Tushar Subhra Dutta • July 28, 2026

Tengu, a newly observed Mirai-based botnet, is making infected IoT devices far harder to clean. It targets internet-facing embedded Linux systems, particularly devices that leave Telnet or other remote administration services exposed. Once installed, the malware can keep a device available for malicious activity and turn a routine removal attempt into an operational problem. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Tengu Botnet Utilizes Hardware Watchdog to Evade Detection and Removal The Tengu botnet, a new variant derived from Mirai, has been discovered by Nozomi Networks Labs. It exploits the hardware watchdog feature in IoT devices to erase forensic evidence during reboots triggered by defenders attempting to kill its processes. This malware targets embedded Linux systems, particularly those with exposed Telnet services, and employs advanced evasion techniques, including fileless execution using the Linux memfd_create system call. Tengu's command-and-control communications include both plaintext and encrypted messages, enhancing its resilience against detection. The botnet can facilitate distributed denial-of-service attacks and maintain persistence on compromised devices. Security experts emphasize the need for timely patching and monitoring of IoT devices to mitigate risks. The malware's sophistication marks a significant evolution in IoT threats, making recovery from infections increasingly challenging. 6 sources 70

Extracted Entities

New Tengu Mirai Botnet Reboots Your IoT Device When You Try to Kill It

The full story

Extracted Entities

Attack Types (2)

Malware (2)

MITRE ATT&CK (1)

Platforms (1)