[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6zedDrR7iFg6KlldDA46a_meRlbRcOgDLKyPqFhfBiE":3},{"article":4,"iocs":43,"watch_terms":51,"solutions":52,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"e8227c1e-a2e7-42a2-99c6-81cd6d8202bc","Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process","tengu-botnet-reboots-compromised-linux-devices-when-defenders-kill-its-process-25a6aa","A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force. Tengu supports 25 distributed denial-of-service (","Tengu, a new Mirai-derived botnet, employs sophisticated persistence and self-defense mechanisms including hardware watchdog abuse to trigger reboots when killed by defenders. The malware spreads via Telnet brute force, supports 25 DDoS methods, and can execute shell commands, proxy traffic, and deliver additional payloads. Nozomi Networks Labs identified architecture-specific samples but found no evidence of widespread real-world deployment.","Tengu botnet uses hardware watchdog to reboot Linux devices when defenders kill its process.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Ftengu-botnet-reboots-compromised-linux.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi0zv7PihU6xAba7-fb5OY-Xv5YIEPM1HhmCu2ET65l5TSKYrPh6q4pYVQRNJtHb9RkvO1oNsBBrsxs50Hm_GRnPKCu4XoG1hhtPOoeGILfRHN99ICGSO72NOGQ6AdUc_haCrQvHRUn4YiyFmCy99WgH1v4-4GRLirZzsV1b5MmCjfTX3a2yWmg1tWOr38\u002Fs1600\u002Ftengu-botnet.jpg","2026-07-28T15:01:33+00:00","2026-07-28T16:00:24.779098+00:00",8,[17,20,23],{"name":18,"type":19},"Nozomi Networks","vendor",{"name":21,"type":22},"Linux","technology",{"name":24,"type":22},"Android","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[44,48],{"type":45,"value":46,"context":47},"ip","64.89.163.8","Tengu C2 server communicating over TCP port 9931",{"type":29,"value":49,"context":50},"Tengu","Mirai-derived botnet with advanced persistence mechanisms",[18],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"patch-management","Automated patch management","Known holes get closed in days, not months.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":84,"name":85,"problem":86,"products":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":113,"name":114,"problem":115,"products":116},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[142],{"slug":143,"name":18,"logo_path":144,"roles":145},"nozomi-networks","\u002Fvendor-logos\u002Fnozomi-networks.png",[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":164},"tengu-botnet-abuses-hardware-watchdogs-to-survive-defender-takedowns-on-linux-devices","Tengu Botnet Abuses Hardware Watchdogs to Survive Defender Takedowns on Linux Devices","The Tengu botnet exploits weak default Telnet credentials and hardware watchdog timers to gain persistence on Linux devices, automatically rebooting the system when defenders attempt to kill its process. This Mirai-derived malware highlights how legacy protocols like Telnet—often left enabled by default on IoT and embedded Linux devices—create an easily exploitable attack surface. The abuse of low-level hardware mechanisms (watchdog timers) to subvert incident response represents an escalation in botnet self-defense sophistication. This matters because defenders cannot simply terminate the malicious process; without disabling the watchdog or reflashing firmware, the device will reboot and re-infect itself, dramatically increasing remediation cost and complexity.",[152,153,154,155,156,157,158,159,160,161,162,163],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-82: Guide to Industrial Control Systems Security","NIST AC-17: Remote Access","NIST IA-5: Authenticator Management","NIST SI-3: Malicious Code Protection","NIST IR-4: Incident Handling","MITRE ATT&CK T1542: Pre-OS Boot (Persistence via Firmware\u002FHardware)","MITRE ATT&CK T1110: Brute Force","IEC 62443-3-3: Industrial Automation and Control Systems Security",{}]