Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

The Tengu botnet exploits weak default Telnet credentials and hardware watchdog timers to gain persistence on Linux devices, automatically rebooting the system when defenders attempt to kill its process. This Mirai-derived malware highlights how legacy protocols like Telnet—often left enabled by default on IoT and embedded Linux devices—create an easily exploitable attack surface. The abuse of low-level hardware mechanisms (watchdog timers) to subvert incident response represents an escalation in botnet self-defense sophistication. This matters because defenders cannot simply terminate the malicious process; without disabling the watchdog or reflashing firmware, the device will reboot and re-infect itself, dramatically increasing remediation cost and complexity.