Tengu Linux malware hides as system processes and floods targets

Published September 7, 2026

Tengu infects Linux-based devices and can hide behind system-like process names, relay traffic, download more software and flood targets. Nozomi saw it installed after attackers guessed Telnet passwords on its own decoy devices, which shows one way in but not how every infection starts.

Report priority
Medium

How it works

  • Nozomi says a dropper observed in its honeypots arrived through Telnet password guessing.
  • That confirms one delivery route, not every Tengu infection.
  • The dropper downloaded and ran a build selected for the device's processor architecture.
  • Once running, Tengu can disguise its process, add startup entries, receive commands, relay traffic, download payloads and flood targets.
  • Some capabilities appear incomplete, and the sources identify no real victim organizations.

What to do

First, ask the device or Linux administrator whether Telnet or another remote administration service is internet-accessible and whether default credentials remain enabled. On a suspicious host, use readlink /proc/PID/exe after replacing PID with the process number and check whether a system-like process points to an unexpected executable. Also review unexpected systemd services, /etc/init.d/tengu, cron entries, /tmp/.proxy.pid and unusual outbound connections. Match findings against the hashes and indicators in the Nozomi analysis. One matching name or path isn't proof, while no match doesn't rule out another build or infection.

Remove unnecessary internet exposure for Telnet and other administration services, replace default credentials, install supported device firmware and separate IoT devices from critical networks. If checks suggest infection, have the device owner or security team review persistence and unexpected network behavior before returning the device to service. The sources don't provide a complete Tengu removal procedure, so use the device vendor's documented recovery process. Updated firmware or removal of one process doesn't confirm that an earlier compromise has been removed.

Technical details

Nozomi identifies Tengu as Mirai-derived based on shared protocol and attack-code traits, while duckie's independent static analysis says its evidence alone doesn't prove direct Mirai lineage. The analyzed 32-bit x86 ELF is 198,288 bytes with SHA-256 897226af37990fa60f25fea00b0509faa0e78d8bee10875c23b9b6ab0b8faed9. It decodes the historical endpoint 64.89.163.8:9931 with XOR key 0x22.

Documented functions include DDoS traffic, SOCKS5 and HTTP CONNECT proxies, host discovery, command execution, payload updates and several persistence methods. Its SSH code performs banner and key-exchange activity, not a demonstrated SSH authentication exploit or credential theft.

References

View Original Source