Listen to this Post
Introduction: The Silent War Against Connected Devices
The world’s growing dependence on internet-connected devices has created a massive battlefield for cybercriminals. Routers, surveillance cameras, smart appliances, embedded Linux systems, and industrial devices often operate quietly in the background, but many of them lack strong security protections. This makes them attractive targets for attackers looking to build hidden botnets capable of large-scale operations.
A newly identified malware family named Tengu represents a more advanced generation of IoT threats. Built from the foundation of the infamous Mirai botnet ecosystem, Tengu goes beyond traditional distributed denial-of-service (DDoS) attacks. Instead of simply overwhelming targets with traffic, it focuses on remaining hidden, maintaining long-term control, stealing intelligence from infected systems, and creating flexible attack infrastructure.
Security researchers have identified Tengu as a sophisticated Mirai-based malware strain designed for poorly protected IoT and embedded Linux environments. Its combination of fileless execution, encrypted command channels, process masquerading, persistence mechanisms, and anti-removal techniques demonstrates how IoT malware continues to evolve into a more professional and resilient threat.
Tengu Malware: The Next Step in Mirai-Based Botnet Evolution
From DDoS Tool to Multi-Purpose Cyber Platform
The original Mirai malware shocked the cybersecurity industry by transforming vulnerable IoT devices into massive botnets capable of launching devastating DDoS attacks. However, modern attackers are increasingly moving beyond simple bandwidth abuse.
Tengu represents this evolution.
Unlike traditional Mirai variants that primarily scan devices, compromise them, and launch attacks, Tengu provides operators with a broader toolkit. The malware can:
Operate as a proxy network.
Collect information about infected devices.
Gather network configuration data.
Download additional malicious payloads.
Remove competing malware families.
Maintain access after system reboots.
Hide its presence from security monitoring tools.
This shift reflects a larger trend in cybercrime: compromised IoT devices are no longer viewed only as disposable attack machines. They are becoming valuable long-term assets inside criminal infrastructure.
Infection Process: Telnet Brute Force Remains the Gateway
Exploiting Weak IoT Security Practices
Despite years of warnings from security researchers, many IoT devices still expose Telnet services with weak or default credentials. Tengu takes advantage of this weakness by conducting brute-force attacks against exposed Telnet interfaces.
Once attackers gain access, the malware deployer launches a shell-script-based downloader.
The dropper identifies the device architecture and retrieves the correct binary version over HTTP. This allows Tengu to target a wide range of Linux-powered hardware, including:
Home routers.
IP cameras.
Embedded network appliances.
Smart entertainment devices.
Android-based TV boxes.
Industrial embedded systems.
The ability to support multiple architectures increases the malware’s potential reach and allows attackers to build larger and more diverse botnets.
Command-and-Control Infrastructure: Hidden Communication Channels
Encryption and Obfuscation Protect the Attackers
Tengu communicates with attacker-controlled command-and-control (C2) infrastructure to receive instructions and report information from infected devices.
Researchers identified hardcoded communication details associated with the malware:
C2 Address: 64[.]89.163.8
Communication Port: 9931
The malware uses XOR-based obfuscation to hide its C2 information, making static analysis more difficult.
Tengu also contains dormant domain-generation capabilities, suggesting that future versions could become more difficult to block by allowing attackers to dynamically rotate infrastructure.
Deep Analysis: Inside Tengu’s Technical Architecture
Fileless Execution and Memory-Based Deployment
One of Tengu’s most dangerous capabilities is its ability to operate without leaving traditional malware files behind.
The malware checks whether it is running from disk or anonymous memory. It then attempts to use the Linux memfd_create() feature to create a memory-only executable.
The malware gives this memory object the name:
systemd-journal
This naming strategy allows Tengu to imitate a legitimate Linux system process.
If memfd_create() is unavailable, the malware uses another approach:
/dev/shm/.journal
It creates a hidden temporary file, deletes the file entry, but keeps the file descriptor open so the malware continues executing.
This technique reduces forensic visibility because traditional file scanners may fail to locate the malicious binary.
Process Masquerading: Pretending to Be Linux System Components
Hiding Behind Trusted Names
Tengu attempts to disguise itself as legitimate Linux services by changing its process name.
The malware may appear as:
/usr/lib/systemd/systemd-journald
or:
[kworker/0:0]
For inexperienced administrators, these names may look like normal operating system processes.
Basic commands such as:
ps aux
could display misleading information, allowing the malware to remain unnoticed.
Security teams must rely on deeper behavioral analysis rather than process names alone.
Useful investigation commands include:
ps auxww
ls -la /proc//exe
cat /proc/<PID>/cmdline
lsof -p <PID>
These commands can help identify processes that do not match their reported identities.
Persistence Mechanisms: Surviving Removal Attempts
Tengu Builds Multiple Recovery Paths
Modern malware developers understand that defenders will attempt removal. Because of this, Tengu includes several persistence techniques.
The malware can establish startup access through:
Fake Systemd Services
Example locations:
/etc/systemd/system/
Attackers can create malicious services that automatically launch after reboot.
Init Scripts
Older Linux environments may be targeted through:
/etc/init.d/
Startup Configuration Changes
The malware can modify boot-related scripts to restore itself.
Cron Persistence
Tengu also attempts cron-based execution:
crontab -l
However, researchers noted that this implementation appears incomplete or unreliable.
Even with one weak persistence method, the remaining mechanisms provide attackers multiple opportunities to regain control.
Guardian Process and Watchdog Abuse
A Malware Family Designed to Fight Back
Tengu does not simply run as a single process.
It launches a detached guardian process that monitors the primary malware instance.
If defenders terminate the main malware process, the guardian attempts to restart it.
This creates an additional challenge for incident responders because removing one process does not guarantee successful cleanup.
The malware also abuses hardware watchdog functionality.
If security teams kill the malware and the watchdog no longer receives expected signals, the device may reboot.
After rebooting, persistence mechanisms can reactivate the malware.
This creates a cycle where infected devices repeatedly return under attacker control.
Why Tengu Represents a Growing IoT Security Crisis
Embedded Devices Remain Attractive Targets
IoT devices often represent the weakest security layer inside organizations and homes.
Many devices suffer from:
Default passwords.
Outdated firmware.
Limited monitoring.
Lack of endpoint protection.
Poor update mechanisms.
Long operational lifespans.
Attackers understand that these devices are rarely inspected compared to traditional computers.
A compromised router or camera may operate unnoticed for months while silently supporting criminal operations.
Indicators of Compromise (IOCs)
Known Tengu Detection Information
Security teams investigating possible infections should monitor:
Command-and-Control Address
64[.]89.163.8
C2 Communication Port
9931
Potential Process Names
systemd-journald
[kworker/0:0]
Suspicious Memory Execution
Look for:
memfd_create
and deleted executable files still running:
ls -l /proc//exe | grep deleted
Defensive Recommendations Against Tengu
How Organizations Can Reduce Risk
Security teams should consider the following measures:
Disable Unnecessary Telnet Access
Replace Telnet with secure alternatives such as SSH.
Example:
systemctl disable telnet systemctl stop telnet
Change Default Credentials
Every IoT device should use unique administrative passwords.
Monitor Suspicious Network Behavior
Look for:
Unexpected outbound connections.
Unknown external IP communication.
Unusual traffic from embedded devices.
Update Firmware Regularly
Manufacturers frequently release security updates addressing known vulnerabilities.
Segment IoT Networks
IoT devices should not share unrestricted access with critical business systems.
Network segmentation limits damage if a device becomes compromised.
What Undercode Say:
Tengu Shows How IoT Malware Has Entered a New Era
Tengu is not simply another Mirai variant.
It represents the transformation of IoT malware from a simple attack tool into a complete cyber operations platform.
The original Mirai formula was straightforward: scan, infect, and launch DDoS attacks.
Modern variants are much more ambitious.
Attackers now want persistence, intelligence gathering, stealth, and flexibility.
Tengu’s fileless execution demonstrates that IoT malware developers are adopting techniques traditionally associated with advanced desktop malware.
Memory-only execution makes traditional antivirus approaches less effective.
Process masquerading shows that attackers understand how defenders investigate systems.
The use of names like systemd-journald proves that social engineering is not limited to human victims.
Attackers are also manipulating security analysts and automated monitoring systems.
The biggest concern is not only Tengu itself.
The bigger issue is the environment that allows malware like Tengu to spread.
Millions of IoT devices remain exposed with weak passwords and outdated software.
Every vulnerable device represents another possible entry point into global criminal infrastructure.
Organizations often focus heavily on laptops, servers, and cloud environments while ignoring embedded devices.
This creates dangerous blind spots.
A compromised camera or router may appear insignificant, but it can become a hidden bridge into larger networks.
Tengu also demonstrates how cybercriminal groups are competing inside infected environments.
The ability to remove rival malware indicates that IoT botnets have become valuable digital territory.
Attackers are not only attacking users; they are fighting each other for control of devices.
The malware’s watchdog abuse shows increasing operational maturity.
Threat actors are designing malware that actively resists cleanup rather than simply hiding.
Future IoT malware will likely continue adopting techniques from advanced persistent threats.
We should expect more encryption, more fileless execution, and more AI-assisted automation.
The security industry must treat IoT devices as real endpoints, not disposable hardware.
Every connected device needs visibility, monitoring, and lifecycle management.
The Tengu campaign is another warning that the IoT security problem is not disappearing.
It is becoming more sophisticated.
✅ Confirmed: Tengu Is a Mirai-Based IoT Malware Family
Security researchers have identified Tengu as a modern Mirai-related threat targeting Linux-based embedded devices.
The malware includes advanced capabilities beyond classic Mirai DDoS behavior.
Its features include stealth execution, persistence, and encrypted command communication.
✅ Confirmed: Fileless Execution and Process Masquerading Are Major Features
The malware uses memory-based execution techniques involving Linux memory file mechanisms.
It disguises itself as legitimate system processes such as systemd-journald.
These behaviors are consistent with advanced Linux malware techniques.
✅ Confirmed: Weak IoT Security Remains the Main Infection Vector
Telnet brute-force attacks remain one of the most common methods used against poorly protected IoT devices.
Default credentials and exposed services continue to create major risks.
Prediction
(-1) IoT Malware Will Become More Difficult to Detect as Attackers Adopt Advanced Stealth Techniques
Future IoT malware families will likely move beyond traditional botnet behavior.
Attackers are expected to use stronger encryption, AI-assisted targeting, and more advanced persistence methods.
The number of vulnerable connected devices will continue increasing as IoT adoption expands faster than security improvements.
Without stronger device management, automated patching, and better network monitoring, threats similar to Tengu could become a major component of future cyberattacks.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
