Tengu Botnet Uses Hardware Watchdog for Linux Persistence

A newly identified botnet, dubbed Tengu, has demonstrated a sophisticated persistence mechanism on compromised Linux devices by leveraging the hardware watchdog timer. This technique allows Tengu to automatically reboot a device when its primary process is terminated by security defenders, thereby reactivating its other persistence methods and ensuring its continued operation. Nozomi Networks Labs, a cybersecurity research firm, observed the initial infection vector for Tengu, noting that the botnet's dropper was distributed via brute-force attacks targeting Telnet credentials. This method of initial access exploits weak or default passwords commonly found on internet-facing Linux systems, making them vulnerable to automated scanning and exploitation.

Tengu is derived from the Mirai botnet, a notorious family of malware known for its use in large-scale distributed denial-of-service (DDoS) attacks. The hardware watchdog timer is a crucial component in embedded systems and servers, designed to reset the system if it becomes unresponsive. By manipulating this timer, Tengu can effectively force a system reboot. When a defender attempts to kill the botnet's main process, the watchdog timer is triggered, leading to a system restart. Upon reboot, Tengu's secondary persistence mechanisms, which are designed to survive reboots, can then re-establish the botnet's presence and relaunch the main process.

This advanced persistence strategy makes Tengu particularly challenging to eradicate. Traditional methods of removing malware, such as terminating processes, are rendered less effective because the botnet can automatically reinfect the system through the watchdog mechanism. The reliance on Telnet for initial compromise indicates that Tengu targets devices with exposed and unsecured remote access services. The botnet's capabilities extend to supporting at least 25 different types of distributed denial-of-service attacks, suggesting its potential for widespread disruption. The discovery of Tengu highlights the ongoing evolution of botnet tactics, with attackers increasingly incorporating hardware-level persistence to evade detection and removal efforts.

The implications of Tengu's persistence mechanism are significant for network defenders and system administrators. It underscores the need for robust security practices, including strong password policies, regular security patching, and the disabling of unnecessary services like Telnet. Furthermore, it suggests that security solutions may need to incorporate more advanced monitoring capabilities that can detect and respond to hardware-level manipulations. The Mirai lineage of Tengu also points to a continued threat from established botnet families that are being updated with new and more evasive functionalities. The ability of Tengu to survive process termination and reboot cycles presents a formidable challenge in maintaining the security and integrity of Linux-based systems.