FHN 
A new Linux-based bot called Tengu is attracting attention because of the way it hides on infected machines and uses them to generate different types of network attacks.
The malware can disguise itself as a normal Linux kernel process, remain active after a reboot, and communicate with attackers through a hidden control endpoint.
Researchers say the malware appears designed for servers, embedded Linux devices, and IoT-related systems. Its exact method of getting onto vulnerable devices is still unknown.
Built to Stay Out of Sight
Tengu does more than simply run in the background. It takes several steps to make detection and removal more difficult.
The malware can:
- Rename itself to look like a Linux kernel worker.
- Reduce the chance of being terminated when the system runs low on memory.
- Hide normal output while running.
- Continue operating even after its original executable is removed.
- Create multiple methods to start automatically after a reboot.
Researchers observed persistence through systemd, SysV startup scripts, OpenWrt scripts, scheduled tasks, and local startup files.
Using several persistence methods allows the malware to survive across different Linux environments.
More Than Just a DDoS Bot
Tengu includes several capabilities that can be used together during an attack.
It can generate different types of network traffic, including UDP floods, HTTP requests, and SSH connection activity. It also supports proxy functionality, allowing compromised machines to act as traffic relays.
The malware can gather basic information about the infected system and network before communicating with its operators.
Its HTTP functionality supports common request methods such as GET, POST, and HEAD, while randomized forwarding headers can make the generated traffic less predictable.
This combination gives attackers more flexibility than a basic DDoS-only malware.
Multiple Ways to Flood a Target
Tengu’s UDP attack functionality includes two approaches.
One can create raw IPv4 packets with controlled network-header information, while another uses standard datagram sockets. Having both options allows the malware to continue generating traffic even when raw network access is restricted.
The malware also includes SSH-related activity that performs connection and handshake operations. Researchers did not find evidence that this capability is being used to exploit SSH authentication.
The larger concern is the variety of attack methods available from a single infected device.
Why Linux and IoT Devices Are at Risk
Linux servers and internet-connected devices are attractive targets for botnet operators because many remain exposed to the internet and may not receive regular security maintenance.
Once compromised, a device that appears to be operating normally could quietly become part of a larger attack infrastructure.
Tengu’s ability to hide its process, establish persistence, and support multiple traffic-generation methods makes these infections particularly difficult to spot through basic monitoring.
What Security Teams Should Watch For
Organizations managing Linux servers, embedded systems, or IoT devices should look for unusual behavior rather than relying only on malware signatures.
Important warning signs include:
- A suspicious process pretending to be a kernel worker.
- Unexpected changes to memory-management settings.
- New systemd services or startup scripts.
- Unknown scheduled tasks.
- Unusual UDP traffic or large traffic bursts.
- Unexpected SSH connection activity.
- HTTP traffic containing unusual forwarding headers.
- Connections to unknown command-and-control infrastructure.
If a device is suspected of being compromised, it should be isolated and investigated before removing suspicious files or persistence mechanisms.
Tengu highlights how Linux-based botnets continue to evolve beyond simple DDoS functionality.
By combining stealth, persistence, proxy capabilities, and multiple attack methods, the malware can turn an ordinary Linux or IoT device into a remotely controlled attack platform.
Keeping internet-facing systems patched, removing unnecessary services, restricting remote access, and continuously monitoring network behavior can significantly reduce the chance of devices becoming part of the next botnet.
IoCs
| Type | Indicator | Description |
|---|---|---|
| File name | tengu_sample | Name assigned to the analyzed Linux ELF sample |
| IPv4 address | 64[.]89[.]163[.]8 | Decoded command-and-control endpoint address |
| TCP port | 9931 | Port paired with the recovered command-and-control address |
| Process name | [kworker/%d:%d] | Kernel-worker-style process-name format used for masquerading |
| Init path | /etc/init.d/tengu | Tengu-linked startup artifact |
| PID file | /tmp/.proxy.pid | File associated with the malware’s proxy capability |
| Systemd description | System Helper Service | Description used in the created systemd service template |
| MD5 | 3a1069cd649e22b87cbccf0c36b69f4b | MD5 hash of the analyzed sample |
| SHA-1 | 097522a52986982b9eefc29f95efdd9d3b6032e7 | SHA-1 hash of the analyzed sample |
| SHA-256 | 897226af37990fa60f25fea00b0509faa0e78d8bee10875c23b9b6ab0b8faed9 | SHA-256 hash of the analyzed sample |
About the Author
