Tengu, a modern Mirai-based malware family, is targeting poorly secured IoT and embedded Linux devices with fileless execution, encrypted command-and-control communications, and aggressive self-defense features.
Security researchers identified Tengu as a distinct threat because it expands on the usual Mirai botnet model.
While Mirai variants are commonly used for distributed denial-of-service attacks, Tengu can also run proxies, collect device and network data, download new payloads, remove competing malware, and maintain persistence after defenders attempt to remove it.
The malware was observed reaching devices through Telnet brute-force attacks.
Its shell-script dropper downloads architecture-specific binaries over HTTP, allowing it to infect a broad range of Linux-based hardware, including routers, cameras, embedded systems, and potentially Android-based TV boxes.
Once active, Tengu connects to its command-and-control server at 64[.]89.163.864[.]89.163.864[.]89.163.8 over port 993199319931.
The malware hides this address using XOR obfuscation and includes dormant domain-generation logic. Its initial registration, heartbeat traffic, and command output are sent in plaintext.
However, commands sent from the server to infected devices are protected with a custom ChaCha20/Poly1305-like authenticated encryption scheme.
Tengu Masquerades as Journald
One of Tengu’s most notable evasion techniques is its ability to run from memory while pretending to be a trusted Linux process.
The malware checks whether it is executing from disk or an anonymous memory area. It then attempts to create an in-memory file through memfd_create, using the name systemd-journal.
If that Linux feature is unavailable, Tengu creates a hidden file at /dev/shm/. journal, deletes it from the file system, but keeps its file descriptor open.
The malware copies itself into this memory-backed location and runs again using execve. During this process, it changes its displayed command-line name to /usr/lib/systemd/systemd-journald.
This can cause basic process-monitoring tools and ps output to show the malware as the legitimate systemd-journald service. Tengu also uses names resembling Linux kernel workers, including [kworker/0:0], to make detection harder.
The malware supports several persistence methods. It can create a fake systemd service, install an init.d service, modify startup scripts, and attempt cron-based persistence.
Researchers noted that the cron implementation appears incomplete or unreliable. However, the other methods can help it restart after a reboot.
Tengu also launches a detached guardian process that checks whether the main malware process is still alive. If the primary process stops, the guardian attempts to restart the installed binary.
It further uses the device watchdog as an anti-removal tool. If defenders kill the malware, the watchdog may stop receiving keepalive signals and force the infected device to reboot, giving Tengu’s persistence methods another opportunity to launch the malware, nozominetworks said.
Indicators of Compromise
| IOC Type | Indicator | Description |
|---|---|---|
| C2 IP address | 64[.]89.163.8 | Tengu command-and-control server |
| C2 port | 9931 | Hardcoded C2 communication port |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
