ThreatCluster

Tengu Mirai: New Linux Botnet Threat Emerges

First seen 7 Sep 2026, 20:33 UTC • •49

Article Content

1 / 3

Browse articles

ThreatCluster •September 8, 2026 at 20:16 UTC

•Tengu malware mimics Linux kernel processes to evade detection.
•Targets include servers, embedded devices, and IoT systems.
•Capable of launching DDoS attacks and SSH probing.

A new Linux malware named Tengu has been identified, combining Mirai-style botnet techniques with advanced persistence and DDoS capabilities. This 32-bit ELF malware disguises itself as a Linux kernel worker process and targets servers, embedded devices, and IoT systems. Tengu's features include SSH probing and proxy capabilities, making it a versatile threat. The malware is designed to remain hidden and can generate significant traffic floods against selected targets. Its stealthy nature and broad attack vector increase the risk for various Linux environments. Currently, there are no specific CVEs or patches mentioned for this malware, indicating a potential gap in defenses. Security professionals are advised to monitor their systems for unusual activity related to this threat.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 45d ago How this analysis works

Timeline

2026-09-07

Tengu malware identified

Security researchers reported the discovery of Tengu, a new Linux bot that combines Mirai techniques with advanced persistence.

2026-09-07

Tengu's capabilities detailed

The malware's ability to disguise itself as a kernel worker and perform DDoS attacks was highlighted in multiple reports.

Cybersecuritynews

More articles in this cluster (2)

Threat Graph

7 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Botnet
DDoS
Malware
T1036 - Masquerading

Malware (1)

Mirai

Affected Platform (1)

Linux

Threat Actor (1)

tengu

Relationships

tengu uses Mirai
tengu uses Botnet
tengu uses DDoS
tengu uses Malware
tengu uses T1036 - Masquerading
tengu related to Linux

Following this threat?

Track tengu and Mirai in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both…

Cling Botnet Exploits Realtek SDK Flaw Using STUN Traffic for C2 The Cling botnet has been identified as exploiting a critical vulnerability (CVE-2021-35394) in the Realtek Jungle SDK, allowing attackers to deploy malware that disguises command-and-control (C2) traffic as legitimate STUN protocol exchanges. This vulnerability, which has a CVSS score of 9.8, was first exploited…