Tengu: The Botnet That Turns Reboot Into a Forensic Trap

Discovered by Nozomi Networks Labs, the Mirai variant Tengu abuses the hardware watchdog timer on embedded Linux devices to force an automatic reboot and wipe volatile forensic evidence when analysts terminate its main process.

On July 27, 2026, Nozomi Networks Labs published its analysis of Tengu, a Mirai-derived botnet that subverts the very logic of incident response on IoT devices. The malware does not merely infect; it turns process termination — the first reflex of any analyst — into a trigger for the automatic destruction of volatile evidence. The mechanism is the hardware watchdog timer, a safety circuit present in virtually every embedded Linux device.

Key Takeaways

Tengu is a Mirai-derived botnet discovered by Nozomi Networks Labs' machine-learning anomaly detection system.
The malware abuses the hardware watchdog timer to force an automatic reboot in roughly 30 seconds when the main process is terminated, wiping volatile forensic evidence.
Tengu overwrites the system reboot and shutdown binaries with the string 'ELFOOD', preventing normal restart and frustrating manual countermeasures.
The botnet supports 25 DDoS methods, fileless execution via memfd_create, a SOCKS5 proxy, and masquerading as systemd-journald, with binaries compiled for six architectures.

How Tengu Turns the Watchdog Into the Malware's Guardian

The watchdog timer is an architectural component, not a vulnerability to be patched. Found in routers, cameras, DVRs, and smart-home devices, it is designed to automatically restart a hung system. Tengu creates an artificial dependency: a child process, disguised as [kworker/0:0], reopens the watchdog device and feeds the keepalive signal only while the main process remains alive.

According to the analysis published by The Hacker News, the timer expires in approximately 30 seconds. An analyst who terminates the main process — the most immediate action in incident response — cuts the keepalive. The watchdog expires, the system reboots, and with it vanish running processes, open network connections, memfd_create artifacts, and other volatile evidence. At reboot, already-installed persistence mechanisms relaunch the malware.

TechTimes, reporting on Nozomi's analysis, emphasizes that "the technique Tengu uses is not a device-specific exploit, but an architectural property present in virtually every embedded Linux device on the market." This generality makes the threat cross-cutting across entire hardware categories, not tied to a single vendor or product family.

Internal Countermeasures: When the Defender Can No Longer Reboot

Tengu implements a second active line of defense against analysts. The malware overwrites the ELF headers of the system reboot and shutdown binaries with the string 'ELFOOD', corrupting them so that manual reboot commands fail. This technique, documented by both Nozomi Networks and The Hacker News, blocks a standard countermeasure: forcing a clean reboot to interrupt memory-resident malware.

Fileless execution further reinforces concealment. Tengu uses the memfd_create system call to execute the binary from an anonymous file descriptor residing in RAM, leaving no trace on disk. The process relabels itself as /usr/lib/systemd/systemd-journald, blending in with legitimate system services. Sandfly Security, in a generic technical guide on detecting memfd_create fileless malware, explains that this technique renders traditional post-mortem analysis ineffective unless intervention occurs on a live system.

Persistence is multi-layered: a hidden guardian process checks the main process status every 60 seconds; fake systemd services and init/RC scripts are created; an incomplete reference to a cron mechanism based on /proc/self/exe is present. According to Nozomi, this reference may be intentionally incomplete or an unfinished development artifact.

"Most Mirai variants implement few, if any, of these self-defense capabilities" — Nozomi Networks Labs researchers

C2, Encryption, and Infrastructure: The Nozomi Picture

The configured command-and-control server is reachable at IP 64[.]89.163.8:9931. Registration and heartbeat communications occur in plaintext; server commands and updates use a custom ChaCha20/Poly1305-like encryption, according to The Hacker News. Tengu can download additional payloads in ELF or APK format through an IPFS gateway hosted on the same C2 server.

The infrastructure is also tracked outside the Nozomi analysis. URLhaus recorded 17 malicious URLs associated with the same IP address starting June 17, 2026. However, as The Hacker News notes, none of the SHA-256 hashes cataloged by URLhaus match the samples identified by Nozomi. This discrepancy prevents confirmation that the URLhaus URLs specifically distribute Tengu, though they document malicious activity on the same infrastructure. URLhaus classifies the URLs as offline, without however verifying the current status of the C2 channel.

Nozomi has published indicators of compromise that include SHA-256 hashes for six architectures: i386, amd64, MIPS, ARM, PowerPC, and m68k. This exceptionally broad architectural coverage for an IoT botnet suggests a systematic porting effort and a codebase designed for maximum spread.

What to Do Now

Collect volatile evidence before terminating any suspicious process on embedded Linux devices: Tengu's automatic reboot wipes RAM, connections, and memfd_create artifacts within roughly 30 seconds of termination.
Verify the integrity of the system reboot, shutdown, and related binaries on IoT/embedded devices: corruption with strings such as 'ELFOOD' is a specific indicator of this variant.
Scrutinize processes disguised as [kworker/0:0] or systemd-journald for timing anomalies and process parentage: Tengu uses these names to hide the guardian process and the watchdog worker.
Monitor connections to IP 64[.]89.163.8:9931 and watch internal IPFS traffic: the IPFS gateway on the C2 is a documented vector for additional payloads.

From Windows to IoT: The Convergence of Anti-Removal Techniques

The significance of Tengu extends beyond a single sample. Nozomi Networks places it in a broader arc: anti-removal and anti-analysis techniques previously associated mainly with Windows malware are migrating to the IoT ecosystem. The baseline defensive sophistication required of security teams rises accordingly.

The operational paradox is clear. For decades, the reboot has been the desperate sysadmin's weapon: power off, power on, hope. Tengu flips the polarity. The reboot becomes the trap, not the solution. Analysts must now train procedures that contradict instinct: observe before touching, document before terminating, assume memory is fragile and the watchdog is weaponized.

The source provides no estimates of infection scale, nor does it identify the threat actor behind Tengu. It remains unknown whether the dormant DGA logic was ever activated in the field, and whether the incomplete cron mechanism represents an error or a deliberately disabled feature. These limits do not weaken the signal: the active defense architecture demonstrated by Tengu is replicable, and will likely be replicated.

Information verified against cited sources and current as of publication.

Sources

Sources and references