New Tengu botnet uses hardware watchdog for advanced persistence

A new Mirai-derived botnet, dubbed Tengu, was identified with advanced persistence and self-defense mechanisms, including the ability to use a compromised Linux device's hardware watchdog to trigger a reboot when its main process is terminated, according to a recent report by The Hacker News.

Tengu, observed by Nozomi Networks Labs, spreads through Telnet credential brute-forcing and supports 25 DDoS methods, a SOCKS5 proxy, shell command execution, and data collection. It can also update itself and download additional ELF or Android package (APK) payloads for various architectures like MIPS, ARM, and amd64. Its unique persistence strategy involves a guardian process that monitors the main malware and relaunches it if stopped. Critically, it can also leverage the hardware watchdog timer; if the main process is killed, the watchdog is left unfed, causing a device reboot, which then allows Tengu's other persistence methods to reactivate. The botnet also interferes with reboot and shutdown commands by overwriting ELF headers. While specific victims or infection counts are not detailed, the analysis highlights the sophisticated evasion techniques employed by Tengu, making it a notable advancement among Mirai variants.

Source: The Hacker News