Tengu Mirai

Gbhackers •Mayura Kathir • September 7, 2026

A newly analyzed Linux malware sample, dubbed Tengu, combines Mirai-style botnet tradecraft with broad persistence, DDoS, SSH probing, and proxy capabilities. The stripped 32-bit ELF masquerades as a Linux kernel worker process while targeting servers, embedded devices, and IoT-adjacent systems. It has no symbols, uses NX protection and partial RELRO, and carries a SHA-256 hash […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Tengu Mirai: New Linux Botnet Threat Emerges A new Linux malware named Tengu has been identified, combining Mirai-style botnet techniques with advanced persistence and DDoS capabilities. This 32-bit ELF malware disguises itself as a Linux kernel worker process and targets servers, embedded devices, and IoT systems. Tengu's features include SSH probing and proxy capabilities, making it a versatile threat. The malware is designed to remain hidden and can generate significant traffic floods against selected targets. Its stealthy nature and broad attack vector increase the risk for various Linux environments. Currently, there are no specific CVEs or patches mentioned for this malware, indicating a potential gap in defenses. Security professionals are advised to monitor their systems for unusual activity related to this threat. 2 sources 49

Extracted Entities

Tengu Mirai

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)