Tengu Mirai: New Linux Botnet Threat Emerges

A new Linux malware named Tengu has been identified, combining Mirai-style botnet techniques with advanced persistence and DDoS capabilities. This 32-bit ELF malware disguises itself as a Linux kernel worker process and targets servers, embedded devices, and IoT systems. Tengu's features include SSH probing and proxy capabilities, making it a versatile threat. The malware is designed to remain hidden and can generate significant traffic floods against selected targets. Its stealthy nature and broad attack vector increase the risk for various Linux environments. Currently, there are no specific CVEs or patches mentioned for this malware, indicating a potential gap in defenses. Security professionals are advised to monitor their systems for unusual activity related to this threat.

Key Points: • Tengu malware mimics Linux kernel processes to evade detection. • Targets include servers, embedded devices, and IoT systems. • Capable of launching DDoS attacks and SSH probing.