Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices

Nozomi Networks Labs disclosed Tengu, a Mirai-derived IoT botnet that infects Internet-facing embedded Linux devices via Telnet brute force and an HTTP shell-script dropper; it supports multiple architectures, 25 DDoS methods, SOCKS5 proxying, encrypted authenticated commands, IPFS and APK payload delivery, and robust self-defense/persistence (memfd_create in-memory execution, watchdog relaunch, reboot-triggered persistence and corruption of recovery binaries). The report emphasizes hardening against removal and anti-analysis measures, offers defender guidance (disable Telnet, change defaults, segment IoT), and provides technical details of its C2, update paths, and capabilities while naming no operator or victim counts.