A new Mirai-variant botnet named Tengu is exploiting a standard hardware reliability feature to defend its foothold on compromised Linux and IoT devices. Security researchers at Nozomi Networks Labs found that the malware abuses the Linux hardware watchdog timer to force an automatic system reboot when defenders attempt to remove it by terminating its process, according to a report by The Hacker News.
This tactic weaponizes a safety feature designed to recover unresponsive systems, turning it into a reinfection engine. Tengu's primary entry point remains brute-force attacks against exposed Telnet services, typically using default or weak credentials. Once inside, it deploys a layered persistence strategy including malicious scripts in autostart locations, cron jobs, and startup hooks.
The key innovation is its reaction to remediation. When security teams follow the conventional step of killing a suspicious process, Tengu's abuse of the watchdog timer triggers a system reboot. This reboot then allows its pre-installed persistence mechanisms to relaunch the malware, undoing the cleanup effort.
This technique fundamentally alters incident response playbooks. The immediate termination of a malicious process is no longer a safe first step. Instead, responders must adopt a strict sequence: first, isolate the device from the network to halt attacks and lateral movement; second, locate and remove all persistence artifacts before touching the running process; third, disable or reconfigure the hardware watchdog to prevent an automatic reboot; fourth, terminate the malware and perform a controlled reboot; and finally, reset all credentials, disable unused services like Telnet, and migrate to key-based SSH authentication.
The campaign underscores a persistent industry-wide vulnerability: the continued exposure of devices with default credentials. Disabling Telnet entirely and enforcing strong, unique passwords on every management interface remain the most effective preventive controls. Organizations should also treat abnormal reboot patterns as a potential indicator of compromise and review hardware watchdog configurations as part of routine hardening.
Tengu does not rely on a new software flaw but on the creative abuse of a system component often overlooked in security reviews. As Mirai derivatives continue to evolve, security teams must update their response procedures to account for hardware-assisted persistence, ensuring that the act of removing malware does not inadvertently guarantee its return.
一個名為 Tengu 的新型 Mirai 變種僵屍網絡，正在利用標準的硬件可靠性功能，以鞏固其在受感染 Linux 和物聯網設備上的立足點。根據 The Hacker News 報導，Nozomi Networks Labs 的安全研究人員發現，該惡意軟件濫用 Linux 硬件看門狗定時器，在防禦者試圖透過終止其進程來移除它時，強制系統自動重新啟動。
此策略將一個旨在恢復無響應系統的安全功能武器化，將其變為重新感染的引擎。Tengu 的主要入侵點仍然是針對暴露的 Telnet 服務進行暴力破解攻擊，通常使用預設或弱密碼。一旦進入系統，它會部署多層持久化策略，包括將惡意腳本置於自動啟動位置、cron 作業和啟動鉤子中。
關鍵的創新在於其對修復措施的反應。當安全團隊按照常規步驟終止可疑進程時，Tengu 對看門狗定時器的濫用會觸發系統重啟。這次重啟隨後允許其預先安裝的持久化機制重新啟動惡意軟件，從而令清理工作功虧一簣。
此技術從根本上改變了事件應急預案。立即終止惡意進程不再是一個安全的初步步驟。取而代之的是，響應者必須採取嚴格的順序：首先，將設備與網絡隔離以阻止攻擊和橫向移動；其次，在接觸運行中的進程之前，定位並移除所有持久化殘留物；第三，禁用或重新配置硬件看門狗以防止自動重啟；第四，終止惡意軟件並進行受控重啟；最後，重置所有密碼、禁用如 Telnet 等未使用的服務，並遷移到基於密鑰的 SSH 認證。
此活動突顯了業界範圍內一個長期存在的漏洞：設備持續暴露於預設密碼之下。完全禁用 Telnet 並在每個管理界面實施強固且唯一的密碼，仍然是最有效的預防控制措施。組織也應將異常的重啟模式視為潛在的入侵指標，並在例行加固工作中審查硬件看門狗配置。
Tengu 並未依賴新的軟件漏洞，而是創造性地濫用了一個在安全審查中常被忽視的系統組件。隨著 Mirai 衍生品持續演變，安全團隊必須更新其應對程序，以應對硬件輔助的持久化技術，確保移除惡意軟件的行為不會無意中保證其卷土重來。