New Tenguin Botnet Exploits Linux Watchdog Timers for Persistence

SECURITY RESEARCHERS HAVE IDENTIFIED A NEW VARIANT OF THE MIRAI BOTNET, DESIGNATED "TENGU," THAT UTILIZES HARDWARE WATCHDOG TIMERS TO MAINTAIN PERSISTENCE ON COMPROMISED LINUX DEVICES. DISCOVERED IN LATE JULY 2026, THE MALWARE EMPLOYS AN ADVANCED EVASION TECHNIQUE DESIGNED TO CIRCUMVENT STANDARD DEFENSIVE MEASURES BY AUTOMATICALLY REBOOTING INFECTED SYSTEMS WHEN ATTEMPTS ARE MADE TO TERMINATE ITS PROCESSES.

THE TENGU BOTNET OPERATORS, WHOSE IDENTITIES REMAIN UNKNOWN, HAVE MODIFIED THE ORIGINAL MIRAI ARCHITECTURE TO INTERACT DIRECTLY WITH DEVICE HARDWARE. UNLIKE PREVIOUS VARIANTS THAT RELIED SOLELY ON SOFTWARE-BASED PERSISTENCE MECHANISMS SUCH AS CRON JOBS OR INIT SCRIPTS, TENGU ACTIVATES A WATCHDOG TIMER UPON INFECTION. THIS TIMER FUNCTIONS AS A SAFETY NET; IF SECURITY PERSONNEL OR AUTOMATED DEFENSE SYSTEMS KILL THE MAIN MALICIOUS PROCESS WITHOUT FIRST DISABLING THE HARDWARE TIMER, THE DEVICE TRIGGERS AN IMMEDIATE REBOOT.

UPON RESTARTING, THE TENGU INFRASTRUCTURE EXECUTES A SECONDARY PERSISTENCE MECHANISM THAT RELAUNCHES THE BOTNET CLIENT. THIS CYCLE EFFECTIVELY NEUTRALIZES MANUAL REMEDIATION EFFORTS WHERE ADMINISTRATORS ATTEMPT TO STOP AND DELETE MALICIOUS PROCESSES IN REAL TIME. BY FORCING A SYSTEM RESTART, THE ATTACKERS ENSURE THE INFECTED DEVICE RETURNS TO THEIR COMMAND-AND-CONTROL NETWORK WITHOUT INTERVENTION.

THE DISCOVERY HIGHLIGHTS AN EVOLVING THREAT LANDSCAPE WHERE BOTNET OPERATORS ARE TARGETING THE UNDERLYING HARDWARE LAYERS OF INTERNET-OF-THINGS (IoT) DEVICES AND SERVER INFRASTRUCTURE. LINUX-BASED SYSTEMS, WHICH POWER A SIGNIFICANT PORTION OF GLOBAL NETWORKED DEVICES FROM INDUSTRIAL CONTROLLERS TO WEB HOSTS, ARE PARTICULARLY VULNERABLE IF WATCHDOG FUNCTIONS ARE ENABLED BY DEFAULT OR MISCONFIGURED.

SECURITY EXPERTS NOTE THAT THE TENGU STRATEGY REQUIRES ATTACKERS TO HAVE SUFFICIENT PRIVILEGES ON THE TARGET SYSTEM TO CONFIGURE HARDWARE TIMERS. HOWEVER, ONCE ESTABLISHED, THIS METHOD PROVIDES A ROBUST DEFENSE AGAINST PROCESS-KILLING COUNTERMEASURES COMMONLY USED IN INCIDENT RESPONSE PLAYBOOKS.

THE FULL SCOPE OF TENGU'S DEPLOYMENT REMAINS UNCLEAR AS OPERATORS HAVE NOT PUBLICLY CLAIMED RESPONSIBILITY. IT IS UNKNOWN HOW MANY DEVICES ARE CURRENTLY INFECTED OR WHETHER THE BOTNET HAS BEEN ACTIVATED FOR LARGE-SCALE DISTRIBUTED DENIAL-OF-SERVICE ATTACKS.

DEFENSIVE STRATEGIES NOW REQUIRE ADMINISTRATORS TO VERIFY WATCHDOG TIMER STATUS AND DISABLE THEM IF NOT CRITICAL BEFORE ATTEMPTING TO TERMINATE SUSPICIOUS PROCESSES. WITHOUT THIS STEP, STANDARD REMEDIATION MAY UNINTENTIONALLY TRIGGER THE REBOOT LOOP PERPETUATED BY TENGU.

AS INVESTIGATIONS CONTINUE INTO THE ORIGIN OF THE MALWARE AND ITS COMMAND-AND-CONTROL INFRASTRUCTURE, QUESTIONS PERSIST REGARDING WHETHER OTHER BOTNET OPERATORS WILL ADOPT SIMILAR HARDWARE-BASED EVASION TECHNIQUES. THE INCIDENT MARKS A SIGNIFICANT SHIFT IN HOW CYBERCRIMINALS MAINTAIN ACCESS TO COMPROMISED SYSTEMS.