A recently discovered Linux botnet malware named “Tengu” is raising alarms for its stealthy design and aggressive distributed denial-of-service (DDoS) tactics. Engineered as a 32-bit statically linked ELF binary, Tengu targets servers, embedded systems, and Internet of Things (IoT)-adjacent devices. Instead of brute‐force access or credential theft, its real strength lies in staying hidden and launching resource-draining attacks.
Stealth, Persistence, and Host Tampering
Tengu aims to blend into the system by renaming its process with a kernel-worker-style label so it looks like an ordinary Linux worker thread. It also modifies OS out-of-memory (OOM) settings to make sure the process isn’t killed under memory pressure. Standard output and error are silenced, and it retrieves its own executable path—even if the file has been removed. Multiple persistence mechanisms were implemented: systemd services, SysV and OpenWrt startup scripts, scheduled cron tasks, and other local startup entries all serve as means to ensure the malware survives reboots.
DDoS and Auxiliary Capabilities
Once established, Tengu opens up a powerful arsenal. It can flood targets using two UDP modes—one using raw IPv4 packet crafting (enabling spoofed packets where allowed), the other relying on regular datagram sockets for environments that block raw sockets. It also sends traffic via HTTP requests (GET, POST, HEAD) with randomized forwarding headers, operates HTTP CONNECT and SOCKS5 proxy functions, and simulates parts of the SSH handshake—though without breaking authentication.
These combined features allow operators multiple vectors to exhaust either bandwidth or application resources. Infected devices can serve as relays, proxies, or direct attack sources. While no campaign volume or victim count has yet been confirmed, the potential exists for widespread damage thanks to Tengu’s stealth, flexibility, and durable infection methods.
Indicators and Defensive Measures
Researchers provided several indicators of compromise (IoCs) to help defenders detect Tengu. Some include process names matching pattern “[kworker/%d:%d]”, an init script path of “/etc/init.d/tengu”, a PID file located at “/tmp/.proxy.pid”, and a systemd service titled “System Helper Service”. Cryptographic hashes for the analyzed sample are also published. The command-and-control endpoint observed is 64.89.163.8 on port 9931.
To catch Tengu in action, monitoring teams should look beyond signature-based detection. Behavior-based indicators include: kernel-worker-style processes in process listings, unexpected changes in OOM configuration, new or unusual startup scripts or service units, and deleted executables that still run. Network-side warning signs include spikes in raw UDP traffic, unusual SSH handshake events, or web floods with randomized forwarding headers. Isolating suspicious hosts, preserving evidence before removal, and rotating exposed credentials are recommended best practices.
For mitigation: ensure internet-facing devices are up to date with security patches, disable unneeded remote administration endpoints, and restrict exposure of devices to untrusted networks. Implement strong access control and monitor for repeated unauthorized access attempts, which often precede botnet recruitment.
Tengu represents a notable addition to the evolving landscape of Linux-based malware. Its mix of concealment, cross-platform persistence, and multi-vector attack options makes it especially concerning for environments with many embedded or IoT-adjacent devices. To dodge breakthrough infections, organizations must adopt defense in depth: combining robust endpoint hygiene, network anomaly detection, and ideally threat intelligence sharing. Vigilance against such stealthy bots is now more important than ever.
