"Most Mirai variants implement few, if any, of these self-defense capabilities," Nozomi Networks Labs wrote — and its July 27, 2026 analysis shows why. The newly documented Mirai-derived botnet Tengu layers multiple persistence and self-protection techniques that can force a compromised Linux device to reboot when defenders simply kill the main malware process, giving the malware fresh chances to relaunch.
How Tengu’s self-defense and persistence work
Nozomi’s analysis describes a set of overlapping persistence mechanisms. Once installed, the bot forks a detached guardian process that checks the principal malware process every 60 seconds and relaunches the installed binary if it stops. The malware can create a fake systemd service, add init and RC scripts, alter shell startup files, and mark its installed binary immutable. A cron-based routine also exists, although Nozomi observed the sample’s cron entry referring to /proc/self/exe appears unfinished or broken.
In addition to these file- and service-based measures, Tengu deploys a hardware-watchdog abuse: a background worker masquerading as [kworker/0:0] reopens the watchdog device when available, arms it with an approximately 30-second timeout, and sends keepalive signals only while the main malware process remains alive. If a defender kills that main process, the watchdog stops being fed and the device reboots — at which point the other persistence mechanisms may relaunch the bot.
Capabilities: DDoS, proxies, updates, and payloads
Nozomi notes Tengu supports 25 distributed denial-of-service methods and can run a SOCKS5 proxy, execute arbitrary shell commands, and collect system and network data. The malware is able to update itself and fetch additional payloads in either Executable and Linkable Format (ELF) or Android package (APK) form. Architecture-specific samples listed in the report include i386, amd64, MIPS, ARM, PowerPC, and m68k.
Network communications in the analyzed sample were configured for a command-and-control (C2) server at 64[.]89.163.8 over TCP port 9931. Registration, heartbeat traffic, and command output were sent in plaintext; server commands and updates used a custom ChaCha20/Poly1305-like authenticated encryption scheme. The malware can also obtain a content identifier from an InterPlanetary File System (IPFS) gateway hosted on the same server, validate returned content as an ELF or APK, and execute or install it. Nozomi assessed the APK path likely targets poorly secured Android TV boxes or similar devices, but did not document confirmed Android victims.
Defensive disruption and tampering
Tengu carries a hardcoded list of reboot and shutdown utilities and overwrites those utilities’ ELF headers with the string ELFOOD. That modification can interfere with the normal commands defenders might use to safely restart or power down a compromised device. Nozomi highlighted this and the watchdog behavior as distinguishing features compared with most Mirai-derived samples it tracks.
Observed infrastructure and telemetry limits
Nozomi’s technical write-up shows what Tengu can do but does not name an operator, specific vendors or device models, infection counts, or confirmed real-world victims. URLhaus independently recorded 17 malware URLs hosted at 64[.]89.163.8 beginning June 17, 2026 — including a shell script, multiple ELF files labeled Mirai, and an APK — with the most recent payload entries first seen July 7 and all 17 URLs offline as of July 28. URLhaus did not identify those files as Tengu and reported that none of the SHA-256 hashes it listed matched Nozomi’s sample, meaning that its telemetry confirms Mirai-related hosting at the address but not a direct sample match to Nozomi’s Tengu.
Neither Nozomi nor URLhaus establishes whether the C2 service on port 9931 or the IPFS gateway on port 8080 was reachable in the wild, and Nozomi does not say whether the configured C2 at 64[.]89.163.8:9931 issued any commands.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Follow Nozomi’s specific mitigations — remove internet exposure for Telnet and other unnecessary administrative services; replace default credentials; update device firmware; segment IoT networks; and review systemd services, init scripts, shell startup files, and cron-related paths before returning a suspected device to service.
- Procurement and operations leaders: The report underlines the operational risk from devices that allow modification of system binaries or lack firmware protections; ask vendors about protections for system utilities and firmware update controls, and consider segmentation and lifecycle processes for embedded devices.
- End users and device owners: Limit remote administration exposure (Telnet was the vector Nozomi’s dropper used to reach its honeypots via credential brute force) and replace default credentials on networked devices before connecting them to broader networks.
Tengu demonstrably adds layers of persistence and self-defense to the Mirai playbook — from filesystem and service tricks to a hardware watchdog that can force a reboot when defenders attempt a straightforward kill. Nozomi’s analysis maps the malware’s capabilities and attack surface; open questions remain about how far any particular sample has spread and whether the observed C2 and IPFS services were operational in the wild. The practical takeaway is concrete: a defender who simply kills a process may trigger a reboot and a re-infection unless device exposure, credentials, and firmware protections are addressed first.
