Tengu Botnet

Technical Analysis

Tengu is a Mirai-family botnet variant discovered by Nozomi Networks Labs propagating through Telnet brute-force attacks against weak or default credentials on Linux-based devices. Its notable innovation is abuse of the Linux hardware watchdog subsystem: if defenders terminate Tengu's primary process, the watchdog (normally used to auto-recover hung systems) triggers a device reboot, giving secondary persistence mechanisms another opportunity to reinfect the host. The malware supports at least 25 distinct DDoS attack modules, indicating a flexible, modular architecture typical of Mirai derivatives. Because it targets any Linux device reachable over Telnet with weak credentials, this includes edge servers, gateways, and embedded systems that may host or orchestrate AI agent runtimes or RAG pipeline components — a compromise or DDoS disruption of such infrastructure could degrade availability of agent tool-calling endpoints or expose API keys stored on the same host if lateral movement occurs.

Affected Systems

Linux-based IoT and embedded devices with Telnet enabled and weak/default credentials; devices supporting hardware watchdog timers

Indicators of Compromise

• Telnet brute-force login attempts against IoT/embedded honeypots
• Dropper delivered via Telnet post-authentication
• (No specific hashes, IPs, or domains published in source data)

Remediation Steps

1. 1

   Disable Telnet

   Disable Telnet services on internet-facing Linux and IoT devices; use SSH with key-based authentication instead.

2. 2

   Enforce strong credentials

   Replace default and weak passwords on all network-connected devices with strong, unique credentials.

3. 3

   Network segmentation

   Isolate IoT and embedded devices from critical infrastructure, including hosts running AI agent or automation workloads, using firewall rules and VLANs.

4. 4

   Monitor watchdog activity

   Audit and monitor hardware watchdog configuration and reboot logs for unexpected triggers indicative of malware persistence.

5. 5

   Patch and harden firmware

   Apply vendor firmware updates and disable unused services to reduce the attack surface on embedded Linux devices.