[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIwUrzxb-twUbmvJNgfdPpz0NnKKRZIXguLi0MAUTnXw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"744d2aab-183b-4bfc-a208-28e83088c8ff","tengu-botnet-abuses-hardware-watchdogs-to-survive-defender-takedowns-on-linux-devices","e8227c1e-a2e7-42a2-99c6-81cd6d8202bc","Tengu Botnet Abuses Hardware Watchdogs to Survive Defender Takedowns on Linux Devices","The Tengu botnet exploits weak default Telnet credentials and hardware watchdog timers to gain persistence on Linux devices, automatically rebooting the system when defenders attempt to kill its process. This Mirai-derived malware highlights how legacy protocols like Telnet—often left enabled by default on IoT and embedded Linux devices—create an easily exploitable attack surface. The abuse of low-level hardware mechanisms (watchdog timers) to subvert incident response represents an escalation in botnet self-defense sophistication. This matters because defenders cannot simply terminate the malicious process; without disabling the watchdog or reflashing firmware, the device will reboot and re-infect itself, dramatically increasing remediation cost and complexity.","**Immediate actions:**\n- Disable Telnet on all Linux and IoT devices immediately and replace with SSH using key-based authentication.\n- Audit all internet-facing devices for default or weak credentials and enforce strong, unique passwords across the fleet.\n- Isolate any suspected compromised devices from the network before attempting process termination to prevent lateral spread.\n\n**Long-term improvements:**\n- Maintain a complete, up-to-date inventory of all Linux and IoT devices, including firmware versions and enabled services.\n- Implement network segmentation to restrict IoT and embedded Linux devices to dedicated VLANs with strictly controlled egress rules.\n- Establish a firmware lifecycle policy that includes regular patching and end-of-life replacement for devices that no longer receive vendor security updates.\n\n**Detection measures:**\n- Deploy network-level anomaly detection to flag unusual outbound traffic volumes or DDoS-characteristic patterns from internal devices.\n- Monitor for unexpected hardware watchdog timer interactions and unscheduled device reboots as indicators of compromise.\n- Centralize syslog collection from all Linux devices and alert on unauthorized process execution or shell command invocations.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-82: Guide to Industrial Control Systems Security","NIST AC-17: Remote Access","NIST IA-5: Authenticator Management","NIST SI-3: Malicious Code Protection","NIST IR-4: Incident Handling","MITRE ATT&CK T1542: Pre-OS Boot (Persistence via Firmware\u002FHardware)","MITRE ATT&CK T1110: Brute Force","IEC 62443-3-3: Industrial Automation and Control Systems Security",{},"published","2026-07-28T16:20:48.28063+00:00","2026-07-28T16:20:48.19+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Ftengu-botnet-reboots-compromised-linux.html","tengu-botnet-reboots-compromised-linux-devices-when-defenders-kill-its-process-25a6aa","Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[53,57,61],{"slug":54,"name":55,"problem":56},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":48,"name":62,"problem":63},"Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]