Brute-force initial access and architecture-matched delivery

Tengu shares roots with Mirai but goes considerably further in stealth and self-defense. Infection began with a brute-force attack on an exposed remote-management service using weak or default credentials — no vulnerability, vendor, or device model was involved. A short shell script then pulled down builds matching the target's processor architecture, with versions available for common desktop, embedded, and legacy platforms, making exposed and poorly maintained IoT and embedded Linux devices the natural target for the Tengu botnet.

Fileless execution and continuous anti-analysis

Once running, Tengu decodes its command-and-control address in memory and immediately works to hide itself. It copies its own executable into an anonymous memory-backed file, relaunches from there, and disguises the process name so monitoring tools display it as a legitimate system logging daemon. It hardens itself by ignoring termination signals, disabling core dumps, and instructing the kernel not to select it for termination under memory pressure. Anti-analysis checks run continuously: Tengu exits if a debugger is attached or library-injection variables are present, uses instruction-timing measurements to detect emulation, and periodically hashes its own executable code to detect tampering. All sensitive strings are stored encrypted and decoded only at runtime.

Multi-layered persistence and watchdog abuse

Persistence is where Tengu diverges most from ordinary Mirai variants. A detached guardian process checks the main process every minute and relaunches it if it disappears. On instruction from the server, Tengu can install itself as a fake system service, hook into legacy startup mechanisms, infect shell login scripts, and mark its own binary immutable. Its most aggressive layer abuses the hardware watchdog timer: a background worker disguised as a kernel thread arms the watchdog with a short timeout and sends keepalive signals only while the malware is alive.

Reboot-forced anti-remediation and rival malware suppression

If a defender kills the Tengu process, the keepalives stop and the device reboots, converting a hardware safety feature into an anti-remediation trap that gives the other persistence layers another chance to run. Tengu compounds this by corrupting the reboot and shutdown utilities an administrator would normally use to restart or safely power down the device. It also hunts competing malware, scanning running processes against known rival patterns and killing matches along with their child processes, watching for new process creation so it can react within a fraction of a second.

Capability without confirmed reach

The available intelligence on Tengu describes capability rather than confirmed reach. No operator, campaign, infection count, targeted sector, region, or confirmed victim is identified, no Android infections were documented despite the delivery path, and there is no evidence that the command-and-control server ever issued commands or was reachable. Independent telemetry confirms only that malicious Mirai-related files were hosted at the same address for several weeks before going offline.