Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. Tengu supports 25 distributed denial-of-service (DDoS) methods and can also run a SOCKS5 proxy, execute shell commands,…
Intelligence analysis by Llama
Tengu is a Mirai-derived botnet that can reboot compromised Linux devices using their hardware watchdog. It supports 25 DDoS methods and can run a SOCKS5 proxy, execute shell commands, and collect system and network data.
Imagine you have a computer that's been taken over by a bad guy. The bad guy has set up a special trick so that if you try to stop the bad guy's program, the computer will just reboot and the bad guy can start again. This is what Tengu, a new type of malware, can do. It's like a computer virus that can make the computer do its bidding, even if you try to stop it.
Analysis
A New Mirai-Derived Botnet: Tengu's Persistence and Self-Defense Capabilities
Tengu, a new Mirai-derived botnet, has been observed using a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. This persistence mechanism, combined with its self-defense code, makes Tengu a significant threat to Linux devices.
Tengu's Persistence Mechanisms
Tengu's persistence mechanisms are designed to ensure its continued operation even if its main process is killed. The botnet uses a cron-based persistence routine, which is present but appears unfinished or broken. Additionally, Tengu abuses the device's hardware watchdog to trigger a reboot. A background worker masquerades as [kworker/0:0], reopens the watchdog device if available, arms it with an approximately 30-second timeout, and sends keepalive signals only while the main malware process remains alive.
Tengu's Self-Defense Code
Tengu's self-defense code is designed to prevent defenders from killing its main process. The botnet creates a fake systemd service, adds init and RC scripts, alters shell startup files, and marks its installed binary immutable. This self-defense code makes it difficult for defenders to remove Tengu from compromised devices.
Tengu's Capabilities
Tengu supports 25 distributed denial-of-service (DDoS) methods and can also run a SOCKS5 proxy, execute shell commands, and collect system and network data. The malware can update itself and retrieve additional Executable and Linkable Format (ELF) or Android package (APK) payloads. Nozomi listed architecture-specific samples for i386, amd64, MIPS, ARM, PowerPC, and m68k.
Conclusion
Tengu's persistence and self-defense code make it a significant threat to Linux devices. Defenders should take steps to remove internet exposure for Telnet and other unnecessary administrative services, update firmware, and segment IoT networks. Additionally, defenders should review systemd services, init scripts, shell startup files, and cron-related paths before returning a suspected device to service.
Key points
- Tengu is a new Mirai-derived botnet that can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process.
- Tengu supports 25 distributed denial-of-service (DDoS) methods and can also run a SOCKS5 proxy, execute shell commands, and collect system and network data.
- Tengu's persistence and self-defense code make it a significant threat to Linux devices.
- Defenders should take steps to remove internet exposure for Telnet and other unnecessary administrative services, update firmware, and segment IoT networks.
If defenders take steps to remove internet exposure for Telnet and other unnecessary administrative services, update firmware, and segment IoT networks, they can reduce the risk of Tengu infections. Additionally, by reviewing systemd services, init scripts, shell startup files, and cron-related paths, defenders can identify and remove Tengu's persistence mechanisms.
If Tengu's persistence and self-defense code are not addressed, it can continue to operate and cause significant harm to Linux devices. Additionally, if defenders are not able to identify and remove Tengu's persistence mechanisms, it can lead to a prolonged and difficult-to-resolve infection.
