Tengu Botnet Uses Hardware Watchdog to Erase Forensic Evidence on Reboot

Security researchers at Nozomi Networks Labs have disclosed a previously unknown IoT botnet, named Tengu, that turns one of embedded hardware's most fundamental safety features against the people trying to remove it. When an incident responder attempts to kill Tengu's process on an infected router, camera, or DVR, the malware triggers a forced hardware reboot — destroying the volatile forensic evidence that would have proven the cleanup was even necessary, while the malware reinstalls itself from multiple persistence locations and resumes operation.

The disclosure arrived via Nozomi Networks Labs , whose machine-learning anomaly detection system first flagged Tengu among unknown malware families before researchers conducted a manual deep-dive. The finding matters beyond this single variant: the technique Tengu uses is not a device-specific exploit, but an architectural property present in virtually every embedded Linux device on the market, which means any Mirai-family malware author can now copy it.

The hardware watchdog timer is a purpose-built safety circuit found in essentially all embedded Linux devices — routers, IP cameras, digital video recorders, smart hubs. Its job is to force a system reset if the main software stops responding, protecting remote or unattended devices from permanent lockups. Normally, the device's software sends a periodic "I'm alive" signal to keep the timer from expiring. If those signals stop, the hardware assumes a crash has occurred and reboots the device.

Tengu weaponizes this safety feature in a specific way. When the malware launches, it forks a dedicated child process whose sole function is to continuously feed the watchdog timer. This child process stays alive only as long as the main Tengu process is running. The moment a security responder uses a standard process-kill command to terminate the botnet — the first thing almost any incident responder tries — the child loses its parent, stops feeding the watchdog, and the hardware timer expires in roughly 30 seconds . The device reboots automatically.

That reboot wipes volatile memory. Running process lists, open network connections, in-memory forensic artifacts — everything a responder would need to document the infection — disappears. Meanwhile, Tengu has planted itself across systemd service entries, init.d scripts, shell startup files, and cron directories. The device comes back online with the malware running again, and a responder who didn't know the watchdog trick will almost certainly conclude the device is now clean .

Tengu's evasion suite extends far beyond the watchdog trick. Together, these capabilities describe a level of operational sophistication that Nozomi describes as rare among Mirai derivatives.

When Tengu executes, it uses the Linux memfd_create system call — introduced in kernel version 3.17 — to run its binary from an anonymous RAM-resident file descriptor that never touches disk. There is no file for an antivirus scanner to find. The process then relabels itself as /usr/lib/systemd/systemd-journald , impersonating a legitimate system daemon that routine monitoring scripts are configured to leave alone.

The malware inspects /proc/self/status to check whether a debugger has attached to it. It also monitors for injected analysis libraries, and uses back-to-back reads of the CPU hardware timestamp counter ( rdtsc ) to detect whether execution is being slowed by a single-step debugger or emulator. If any of these checks fail, Tengu exits cleanly .

For code integrity, the malware computes a SHA-256 hash over part of its own in-memory code region at startup, then periodically recomputes and compares. Any analyst who patches the running binary in memory — a standard dynamic analysis technique — changes the hash and triggers self-termination.

Tengu also installs signal handlers that cause it to ignore the standard Unix termination signals that kill and killall send, meaning those commands fail entirely before the watchdog mechanism even comes into play. As a final measure, the malware maintains a list of system binaries related to reboot and shutdown commands, and corrupts their ELF headers , overwriting each file with a junk marker string. Administrators attempting to use those utilities during a recovery attempt will find them non-functional.

Tengu's infection vector is the same one Mirai used when it first appeared in 2016: Telnet brute force against factory-default credentials. Any internet-exposed embedded Linux device still running default usernames and passwords and with Telnet accessible from outside the network is a candidate target.

Communication with the botnet's operators is more sophisticated than classic Mirai variants. The command-and-control server address is obfuscated with XOR encoding and resolved only at runtime. Commands arriving from that server are protected with a ChaCha20/Poly1305-style authenticated encryption scheme — the same algorithm used in modern TLS connections — which makes passive traffic analysis significantly harder than the cleartext or weakly encrypted C2 channels common in older Mirai derivatives. According to Nozomi's technical analysis , operators can instruct infected devices to act as SOCKS5 proxies, exfiltrate detailed system and network information, execute arbitrary shell commands, and download and run additional payloads — including Android APK files, suggesting Tengu's authors may also intend to target Android TV boxes.

For denial-of-service operations, Nozomi's researchers documented 25 registered attack methods covering UDP floods, TCP floods in multiple configurations, ICMP echo floods, and application-layer attacks targeting HTTP, DNS, NTP, SNMP, SIP, SSH, SMTP, FTP, and game-server protocols for Minecraft and Source Engine-based titles.

Tengu also contains dormant domain generation algorithm logic — code that can synthesize new command-and-control domain names on the fly if the primary server is blocked or taken down — though Nozomi did not observe this capability being actively used in the samples analyzed. That dormancy matters: blocking the published C2 IP address alone is not a complete remediation.

The broadest implication of Tengu's design is not the specific malware itself, but the technique it has introduced to the Mirai ecosystem. The hardware watchdog timer is a fixed architectural feature of embedded Linux devices — it is present in essentially every router, camera, and DVR on the market, regardless of manufacturer or firmware version. Tengu's exploit requires no device-specific vulnerability. Any malware that can fork a keepalive process and interact with the /dev/watchdog interface can replicate it.

The original Mirai botnet — built by three college students in 2016 and used to knock out major portions of the US east coast's internet access in the Dyn DNS attack before its creators released the source code publicly — established a pattern that has repeated ever since: once a capability appears in the Mirai ecosystem, it propagates through successor variants. Tengu has now placed the watchdog technique inside that ecosystem.

The core change Tengu demands from incident responders is sequencing: evidence collection must happen before any action that could trigger a reboot, because a reboot will destroy the evidence. Nozomi advises responders to capture volatile artifacts — running process lists, open network connections, in-memory forensics — before attempting to terminate any suspicious process. Given that Tengu is designed to trigger a reboot the moment its process is terminated, this window may be very short.

Responders cannot assume a reboot has returned the device to a clean state. Nozomi recommends examining systemd service entries, init.d scripts, shell startup files such as ~/.bashrc and /etc/profile , and cron-related directories as mandatory steps in any investigation of a device suspected of infection.

Nozomi has published a full indicator-of-compromise set including the C2 IP address 64[.]89.163.8 , SHA-256 hashes for Tengu binaries compiled for x86, AMD64, MIPS, ARM, PowerPC, and m68k architectures, and a YARA detection rule for automated identification. The company's OT/IoT Security Platform has been updated to detect Tengu-infected devices and alert on exploitation attempts.

The defensive steps for Tengu are not new, but Tengu makes the cost of ignoring them more concrete than before.

Disabling Telnet and replacing it with SSH using key-based authentication eliminates Tengu's primary entry point. Nozomi's mitigation guidance also calls for changing factory-default credentials immediately — before connecting any new device to a network — and keeping device firmware current to reduce the number of exploitable vulnerabilities attackers can target.

Network segmentation matters especially for organizations that cannot immediately audit or replace every embedded Linux device on their network. Isolating IoT hardware from enterprise and operational technology networks limits what a compromised device can reach. Monitoring for anomalous outbound connections, SOCKS proxy traffic, and processes impersonating legitimate system daemons can surface an infection before a responder inadvertently triggers the reboot that erases evidence of it.

The broader context is not reassuring: IoT botnets generated 47.1 million DDoS attacks in 2025, more than double the prior year, and the largest single attack reached 31.4 terabits per second. Three million or more devices were simultaneously compromised by the Aisuru, KimWolf, JackSkid, and Mossad botnets before a DOJ disruption operation in March 2026. Tengu is not a departure from that trend. It is an evolution of it — and the watchdog technique it has introduced to the Mirai variant pool means that the standard remediation assumption underlying every IoT incident response playbook — that a power cycle cleans a device — is no longer reliable.

Tengu forks a child process whose only job is to send periodic keepalive signals to the device's hardware watchdog timer — a built-in circuit that resets the device if it stops receiving those signals. When a responder kills Tengu's main process, the child process dies with it, the keepalive signals stop, and the watchdog timer expires in roughly 30 seconds. The hardware then forces a full system reset, wiping volatile memory of any in-memory forensic evidence of the infection. Tengu survives the reboot because it has already planted itself in systemd services, init scripts, and shell startup files.

The hardware watchdog timer is not a vulnerability unique to one device or firmware version — it is a standard architectural feature of virtually every embedded Linux device, including every router, IP camera, and DVR on the market. Tengu's technique requires no device-specific flaw; any future Mirai-family malware can copy it by forking a watchdog-feeding process before its main code begins. Once a technique enters the Mirai variant ecosystem — whose source code has been publicly available since 2016 — it tends to propagate rapidly through successor malware. Incident responders who assume power-cycling a device reliably removes malware need to update that assumption.

Tengu is designed to be difficult to detect using standard methods. Its binary runs from anonymous RAM rather than a file on disk, making file-scanner antivirus ineffective. Its process impersonates a legitimate system daemon called systemd-journald . The published indicators of compromise from Nozomi include the command-and-control IP address 64[.]89.163.8 and SHA-256 hashes for multiple architecture-specific binaries, along with a YARA detection rule. Behavioral indicators to watch for include unexpected outbound connections, SOCKS5 proxy traffic, processes pretending to be legitimate system services, and failed or non-functional shutdown and reboot utilities.

Do not attempt to reboot or power-cycle a suspected device before capturing forensic evidence — doing so is precisely what Tengu is designed to provoke, and it will erase the volatile artifacts you need. If you have the technical capability, capture running process lists, open network connections, and in-memory artifacts first. Then examine systemd service entries, init.d scripts, shell startup files, and cron directories for unauthorized entries before declaring the device clean. For most and small-business users without forensic tools, the practical guidance from Nozomi is to change all device credentials immediately, disable Telnet, update firmware, and if the device is end-of-life and cannot be updated, replace it. Segment IoT devices from any network carrying sensitive data or operational systems.