Tengu

Tengu Botnet Modernizes Mirai with 25 DDoS Methods and Advanced Persistence on IoT and Embedded Linux

A new botnet named Tengu has emerged, targeting Internet of Things devices and embedded Linux systems to conduct denial-of-service attacks, redirect traffic, and maintain persistent access. The malware represents an updated evolution of the Mirai botnet and begins its infection chain through brute-force attacks against exposed Telnet services. Once valid credentials are obtained, it downloads an architecture-specific payload and establishes partially encrypted communication with its command-and-control server. Operators can issue commands to collect system and network information, update the implant, and convert compromised devices into SOCKS5 proxies. The botnet includes 25 distinct DDoS attack methods covering UDP, TCP, and ICMP floods while also targeting services such as HTTP, DNS, NTP, SSH, SMTP, FTP, SIP, Minecraft, and servers running Source Engine or Quake protocols. Its key differentiators lie in robust persistence and self-protection mechanisms, including a secondary watchdog process that restarts the malware every 60 seconds if terminated, fake systemd services, manipulated device watchdogs, and the ability to remove competing malware.