Affected Systems

Linux-based IoT devices and embedded systems across multiple architectures (i386, amd64, MIPS, ARM, PowerPC, m68k). No specific vendor or device model identified. Devices with exposed Telnet services and weak credentials are primary targets.

Exploitation Status

Active campaign observed since at least June 17, 2026. Nozomi Networks Labs detected Tengu reaching honeypots via Telnet brute force. URLhaus recorded 17 malware URLs at C2 server 64.89.163.8 between June 17 and July 7, 2026; all URLs offline as of July 28. No confirmed DDoS victims or infection count published.

Business Impact

Tengu represents an evolution in Mirai-derived botnet persistence. Compromised devices can be weaponized for DDoS attacks (25 methods supported), used as SOCKS5 proxies, or commandeered for shell execution. The watchdog abuse mechanism complicates remediation: killing the malware process triggers a device reboot, allowing persistence mechanisms (systemd services, init scripts, cron jobs, shell startup files) to relaunch the bot. Tengu also sabotages reboot/shutdown utilities by overwriting ELF headers, hindering normal incident response. Organizations with exposed IoT devices, industrial control systems, or Linux-based edge infrastructure face elevated risk of compromise and service disruption.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Remove internet exposure for Telnet (port 23) and other administrative services; enforce firewall rules blocking inbound Telnet connections to IoT and embedded Linux devices.
  • Replace all default credentials on Linux-based IoT devices, routers, and embedded systems with strong, unique passwords.
  • Inspect systemd services, /etc/init.d scripts, /etc/rc.local, shell startup files (.bashrc, .profile), and cron jobs (/etc/cron.d, /var/spool/cron) for unauthorized entries; remove immutable attribute (chattr -i) from suspicious binaries.
  • Block outbound connections to known Tengu C2 infrastructure: 64.89.163.8 (TCP ports 9931, 8080) and monitor for plaintext registration/heartbeat traffic on non-standard high ports.
  • Segment IoT and OT networks from corporate infrastructure; apply firmware updates to Linux-based devices and disable hardware watchdog access for non-privileged processes where feasible.