Back Thehackernews

Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

Thehackernews •[email protected] (The Hacker News) • July 28, 2026

A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process.

If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force.

Tengu supports 25 distributed denial-of-service (

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Tengu Botnet Utilizes Hardware Watchdog to Evade Detection and Removal The Tengu botnet, a new variant derived from Mirai, has been discovered by Nozomi Networks Labs. It exploits the hardware watchdog feature in IoT devices to erase forensic evidence during reboots triggered by defenders attempting to kill its processes. This malware targets embedded Linux systems, particularly those with exposed Telnet services, and employs advanced evasion techniques, including fileless execution using the Linux memfd_create system call. Tengu's command-and-control communications include both plaintext and encrypted messages, enhancing its resilience against detection. The botnet can facilitate distributed denial-of-service attacks and maintain persistence on compromised devices. Security experts emphasize the need for timely patching and monitoring of IoT devices to mitigate risks. The malware's sophistication marks a significant evolution in IoT threats, making recovery from infections increasingly challenging. 6 sources 70

Extracted Entities

Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

The full story

Extracted Entities

Attack Types (3)

CWE Weaknesses (1)

Malware (2)

MITRE ATT&CK (1)

Platforms (1)